Executive brief
A vulnerability has been identified in the Linux kernel's Realtek RTL8723BS wireless driver. A nearby attacker could send a specially crafted Wi-Fi association request to trigger a memory corruption error on the target device. This could lead to a complete system crash or allow the attacker to gain unauthorized control over the affected system.
Technical details
A stack buffer overflow vulnerability exists in the 'OnAssocReq' function within the 'rtl8723bs' wireless driver (drivers/staging/rtl8723bs/core/rtw_mlme_ext.c). The root cause is the direct use of the 'ie_len' field from an incoming Association Request frame as the length for a 'memcpy' operation into a fixed-size 16-byte stack buffer ('supportRate'). An attacker within radio range (Adjacent vector) can provide a malicious IE length greater than 16, leading to kernel stack corruption. Additionally, a secondary overflow was possible during the merging of Extended Supported Rates due to an incorrect bounds check. The fix involves clamping the IE length to the buffer size and correcting the bounds check logic. Patches have been merged into various stable kernel branches.
Affected products
- Linux Linux Kernel 4.12 to 6.12.y
Timeline
- 2025-11-20: other: Vulnerability fix authored
- 2025-12-12: patched: Fix committed to stable tree
- 2025-12-16: disclosed: CVE published
References
- https://git.kernel.org/stable/c/25411f5fcf5743131158f337c99c2bbf3f8477f5
- https://git.kernel.org/stable/c/34620eb602aa432f090b2b784ee5c5070fb16cf9
- https://git.kernel.org/stable/c/4445adedae770037078803d1ce41f9e88a1944b6
- https://git.kernel.org/stable/c/49b7806851f93fd342838c93f4f765e0cc5029b0
- https://git.kernel.org/stable/c/61871c83259a511980ec2664964cecc69005398b
- https://git.kernel.org/stable/c/6ef0e1c10455927867cac8f0ed6b49f328f8cf95
- https://git.kernel.org/stable/c/d129dc2a5d59b4d9cd2cc0b6eeb04df8461199f0