The Linux kernel rtw89 WiFi driver had a vulnerability where pci_get_drvdata was used with the wrong pointer type in AER handlers io_error_detected() and io_resume(). Specifically, an ieee80211_hw pointer was stored via pci_set_drvdata() at probe time, but the handlers retrieved it as a net_device pointer. This mismatch caused netif_device_detach and netif_device_attach to operate on the wrong structure, leading to incorrect memory reads and writes at wrong offsets. The issue was resolved by replacing these calls with ieee80211_stop_queues and ieee80211_wake_queues, aligning with the correct queue stop/start mechanisms used elsewhere in the driver. The fix was validated on the RTL8852CE hardware by invoking the handlers before and after the patch.

The vulnerability could cause incorrect memory access within the WiFi driver due to type confusion, potentially leading to driver instability or crashes. No information about exploitation or broader impact is provided. There are no known exploits in the wild.

A fix has been implemented in the Linux kernel to correct the pointer type usage in the rtw89 driver's AER handlers. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor sources for the exact fixed versions and apply updates accordingly.