Executive brief
A vulnerability was identified in the Linux kernel driver for Realtek RTL8723BS wireless network adapters. An attacker within range of the Wi-Fi signal could send a specially crafted network frame to crash the system or potentially access sensitive information from the computer's memory. This issue affects devices using this specific wireless hardware and could lead to a complete system compromise or service disruption.
Technical details
The vulnerability is located in the rtw_get_ie() function within the rtl8723bs wireless driver (drivers/staging/rtl8723bs/core/rtw_ieee80211.c). The parser trusted the length byte of each Information Element (IE) without verifying that the indicated length fit within the remaining frame buffer. By providing a malformed frame with an IE length larger than the actual data available, an attacker can cause the parser to read beyond the buffer boundary or enter an infinite loop. This is an adjacent-network attack requiring no authentication. Patches have been released across multiple stable kernel branches (e.g., 5.15.x, 6.1.x, 6.6.x, 6.12.x).
Affected products
- Linux Linux kernel 4.12 to 6.17.12
Timeline
- 2025-11-20: other: Initial patch authored
- 2025-12-16: disclosed: CVE published
References
- https://git.kernel.org/stable/c/154828bf9559b9c8421fc2f0d7f7f76b3683aaed
- https://git.kernel.org/stable/c/30c558447e90935f0de61be181bbcedf75952e00
- https://git.kernel.org/stable/c/9829c6e1b2e4180fd18315252ad6faeab6128076
- https://git.kernel.org/stable/c/a54e2b2db1b7de2e008b4f62eec35aaefcc663c5
- https://git.kernel.org/stable/c/b977eb31802817f4a37da95bf16bfdaa1eeb5fc2
- https://git.kernel.org/stable/c/c0d93d69e1472ba75b78898979b90a98ba2a2501
- https://git.kernel.org/stable/c/df191dd9f4c7249d98ada55634fa8ac19089b8cb