Junglewise Threat Intelligence

CVE-2025-68254: Linux Kernel rtl8723bs out-of-bounds read in OnBeacon ESR IE parsing

CVE-2025-68254 · Severity: high · CVSS 7.1 · Published 2025-12-16

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel driver for Realtek RTL8723BS wireless network adapters. An attacker within Wi-Fi range could send a specially crafted wireless beacon frame to trigger a system crash (kernel panic). This could lead to a denial-of-service, disrupting the availability of the affected device.

Technical details

An out-of-bounds read vulnerability exists in the 'rtl8723bs' wireless driver within the Linux kernel, specifically in the 'OnBeacon' ESR IE (Extended Supported Rates Information Element) parsing logic located in 'drivers/staging/rtl8723bs/core/rtw_mlme_ext.c'. The driver fails to validate boundary offsets when accessing memory at *(p + 1 + ielen) and *(p + 2 + ielen). An attacker within radio range can broadcast a malformed beacon frame with an ESR IE positioned at the end of the buffer, causing the driver to read beyond the allocated frame buffer. This can result in a kernel panic (Denial of Service) or potentially leak small amounts of kernel memory. The issue has been resolved by adding explicit boundary checks in the affected parsing function.

Affected products

  • Linux Linux Kernel 4.12 to 5.15.198, 6.1.160, 6.6.120, 6.12.62, 6.17.12

Timeline

  • 2025-11-20: other: Vulnerability fixed in source code
  • 2025-12-12: patched: Patch committed to stable tree
  • 2025-12-16: disclosed: CVE published

References

Related threats