CVE-2026-36355 affects the rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK versions up to 3.4.14. The driver includes debug ioctl handlers (write_mem via ioctl 0x89F5 and read_mem via ioctl 0x89F6) that do not enforce any access control. These handlers are compiled into production builds because the _IOCTL_DEBUG_CMD_ macro is unconditionally defined. This flaw allows local attackers to read and write kernel memory arbitrarily, leading to high impact on confidentiality and integrity. The vulnerability is classified under CWE-782 (Exposure to Sensitive Information Through an Information Leak), CWE-787 (Out-of-bounds Write), and CWE-200 (Information Exposure). There is no vendor-provided patch or remediation information available at this time.

The vulnerability allows an attacker with local access to the system to perform unauthorized memory read and write operations through debug ioctl handlers. This can lead to exposure of sensitive information (confidentiality impact) and unauthorized modification of memory (integrity impact). Availability impact is not indicated. The CVSS 3.1 base score is 7.7 (High), reflecting the ease of exploitation without privileges or user interaction and the significant confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to affected devices and consider disabling or recompiling the driver without the _IOCTL_DEBUG_CMD_ macro if possible to remove the debug ioctl handlers from production builds.