rtw89 PhyStatusIE OOB

Vulnerability analysis

A WiFi driver for Realtek rtw89 chipsets processes PHY status information elements from received frames before validating that each element's reported length fits within the available data. When the hardware reports an element with an unexpected length, the parser reads past the end of the valid data. The fix reorders the parsing so the length is checked first, and the element is only processed when its bounds are confirmed. The vulnerable path is reached whenever the rtw89 interface receives WiFi frames, so any attacker within radio range of a device using an rtw89 WiFi chipset can trigger it by sending frames that cause the hardware to produce malformed status elements; no authentication or local access is required.