A local privilege escalation bug in Realtek’s rtl819x WiFi driver SDK lets any unprivileged user gain full root access. No special permissions needed. No root required at any stage of the attack.
The vulnerability centers on two ioctl calls — 0x89F5 and 0x89F6 — that the driver exposes for reading and writing kernel memory. The problem? Nobody bothered to add capability checks. Any local user can call them.
An exploit called “kpwn” takes advantage of this by scanning kernel memory for the init_task structure, then walking the process list to find and overwrite the current user’s credential structure. The result: instant root. It auto-detects offsets, so it works across different kernel builds without modification.
The scope here is broad. Every device using Realtek’s out-of-tree rtl819x driver SDK is affected — that includes chips like the RTL8192C/D/E, RTL8188E, RTL8812, RTL8881A, and RTL8197F. We’re talking routers, access points, and embedded devices by the millions.
All known SDK versions through v3.4.14B are vulnerable. If you’re running any of these chips, patching won’t be simple — this is baked into the driver itself.
