CVE-2026-64506: Linux Kernel rtw89 WiFi DoS Vulnerability

CVE-2026-64506 Overview

CVE-2026-64506 is a Linux kernel vulnerability in the rtw89 Wi-Fi driver affecting Realtek 802.11ax wireless chipsets. The flaw resides in the drop logic for malformed Aggregated MAC Protocol Data Unit (AMPDU) frames. A previous fix attempted to discard malformed AMPDU frames but incorrectly handled the first AMPDU packet within certain sequence number ranges. The result is unexpected packet drops, most commonly observed under busy traffic conditions during the pairwise rekey process. Affected clients may lose connectivity to the access point (AP). Kernel maintainers resolved the issue by adding an initial state check and limiting status resets to pairwise rekey events.

Critical Impact
Devices using the rtw89 driver can experience unexpected disconnection from Wi-Fi access points during rekey operations under heavy traffic.

Affected Products

Linux kernel builds including the rtw89 Wi-Fi driver
Realtek 802.11ax (Wi-Fi 6/6E) wireless adapters supported by rtw89
Distributions shipping vulnerable stable kernels prior to the referenced fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64506 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64506

Vulnerability Analysis

The rtw89 driver processes AMPDU frames, which aggregate multiple 802.11 MAC Protocol Data Units into a single physical layer transmission for throughput efficiency. A prior commit introduced logic to drop malformed AMPDU frames. That logic failed to correctly evaluate the first AMPDU packet when its sequence number fell within a specific range. As a consequence, legitimate frames were dropped instead of processed. Under sustained traffic during a pairwise rekey, this behavior compounds and disrupts the four-way handshake state, leading to disconnection from the AP. The corrected patch introduces an initial state judgement and restricts the status reset to occur only during pairwise rekey.

Root Cause

The root cause is flawed conditional logic in the AMPDU sequence number validation path. The prior drop routine did not account for the initial state of the reorder buffer for the first packet in a given sequence window. The status reset triggered too broadly across non-rekey traffic, discarding valid frames.

Attack Vector

This is a reliability and denial-of-service class defect rather than a remote code execution vector. Adversarial conditions are not required; ordinary heavy Wi-Fi traffic paired with routine group or pairwise key rotation can trigger disconnections. An attacker on the same wireless medium could potentially amplify impact by inducing frequent rekey events, but no exploitation in the wild has been reported and no Common Weakness Enumeration (CWE) has been assigned.

No verified proof-of-concept code is available. Refer to the Linux Kernel Commit Details and Linux Kernel Commit Snapshot for the patch diff.

Detection Methods for CVE-2026-64506

Indicators of Compromise

Repeated Wi-Fi disconnection events on hosts using Realtek adapters bound to the rtw89 driver
Kernel log entries from rtw89 referencing AMPDU or reorder buffer anomalies
Loss of AP association coinciding with pairwise rekey timing on busy networks

Detection Strategies

Query modinfo rtw89_core and running kernel version to identify hosts on vulnerable kernel builds
Monitor dmesg and journalctl -k output for rtw89 driver warnings during rekey intervals
Correlate wpa_supplicant reauthentication events with kernel-level packet drop counters

Monitoring Recommendations

Track Wi-Fi disconnect frequency per client across the fleet to surface regression patterns
Alert on kernel messages from wireless drivers that align with EAPOL rekey exchanges
Inventory endpoints running kernels that lack the fix commits 63ccdfac8677 and 994994cfadaf

How to Mitigate CVE-2026-64506

Immediate Actions Required

Update affected Linux systems to a stable kernel release that includes both referenced fix commits
Prioritize patching endpoints and IoT devices that rely on rtw89-supported Realtek Wi-Fi 6 adapters
Validate distribution kernel package versions against upstream stable branch backports

Patch Information

The fix is upstream in the Linux kernel stable tree via commits 63ccdfac8677387dfdbd9d4336089e9823280704 and 994994cfadaf1fd362dea9b8d9d633f85dc1b3c3. Both add an initial state judgement to the AMPDU drop logic and restrict the status reset to pairwise rekey scenarios. Apply vendor-supplied kernel updates from your Linux distribution once the backport is available.

Workarounds

Where patching is delayed, reduce pairwise rekey frequency on the AP configuration to limit trigger conditions
Consider temporarily using a wired connection or an alternate Wi-Fi adapter not driven by rtw89
Disable AMPDU aggregation via driver parameters as a last resort, accepting throughput reduction

bash

# Verify installed kernel and rtw89 driver version
uname -r
modinfo rtw89_core | grep -E '^(version|filename)'

# Inspect kernel log for rtw89 events after a disconnect
journalctl -k --since "1 hour ago" | grep -i rtw89