Executive brief
A vulnerability exists in the Linux kernel driver for Realtek RTL8723BS wireless network adapters. An attacker within Wi-Fi range could send a specially crafted wireless beacon frame to trigger a system crash (kernel panic). This could lead to a denial-of-service, disrupting the availability of the affected device.
Technical details
An out-of-bounds read vulnerability exists in the 'rtl8723bs' wireless driver within the Linux kernel, specifically in the 'OnBeacon' ESR IE (Extended Supported Rates Information Element) parsing logic located in 'drivers/staging/rtl8723bs/core/rtw_mlme_ext.c'. The driver fails to validate boundary offsets when accessing memory at *(p + 1 + ielen) and *(p + 2 + ielen). An attacker within radio range can broadcast a malformed beacon frame with an ESR IE positioned at the end of the buffer, causing the driver to read beyond the allocated frame buffer. This can result in a kernel panic (Denial of Service) or potentially leak small amounts of kernel memory. The issue has been resolved by adding explicit boundary checks in the affected parsing function.
Affected products
- Linux Linux Kernel 4.12 to 5.15.198, 6.1.160, 6.6.120, 6.12.62, 6.17.12
Timeline
- 2025-11-20: other: Vulnerability fixed in source code
- 2025-12-12: patched: Patch committed to stable tree
- 2025-12-16: disclosed: CVE published
References
- https://git.kernel.org/stable/c/38292407c2bb5b2b3131aaace4ecc7a829b40b76
- https://git.kernel.org/stable/c/502ddcc405b69fa92e0add6c1714d654504f6fd7
- https://git.kernel.org/stable/c/bb5940193d813449540d8d3a82abc045be41f48a
- https://git.kernel.org/stable/c/bf323db1d883c209880bd92f3b12503e3531c3fc
- https://git.kernel.org/stable/c/c03cb111628924827351e19baa5b073e9b0d723d
- https://git.kernel.org/stable/c/c173ce97d3f0f0c0fefa39139d6d04ba60b5db22
- https://git.kernel.org/stable/c/d1ab7f9cee22e7b8a528da9ac953e4193b96cda5