Executive brief
A vulnerability was identified in the Linux kernel's driver for Realtek RTL8723BS Wi-Fi chips. An attacker with local access to a system could exploit this flaw to read sensitive information from the computer's memory that they should not have access to, or potentially cause a system crash. This affects devices using this specific wireless hardware, such as certain tablets and low-power laptops.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's staging driver for the Realtek RTL8723BS SDIO Wi-Fi chip (drivers/staging/rtl8723bs/core/rtw_mlme.c). The root cause is a logic error in the rtw_restruct_wmm_ie function where the code attempts to access the 'in_ie' array at index 'i + 5' before verifying that 'i + 5' is within the bounds of 'in_len'. This flaw can be triggered during the processing of Wireless Multimedia Extensions (WMM) Information Elements. A local attacker with low privileges can leverage this to read sensitive kernel memory or trigger a kernel oops (denial of service). The issue has been resolved by reordering the conditional check to ensure the index is validated before the array access.
Affected products
- Linux Linux kernel 4.12 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-04-18: patched: Patched in various stable branches including 6.19.x and 6.12.x
References
- https://git.kernel.org/stable/c/12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020
- https://git.kernel.org/stable/c/209644e25757c499e1c1f08c071ea0386d4448b6
- https://git.kernel.org/stable/c/4dd2d9cf563c54e09d5f7eacf95c5b8f538b513b
- https://git.kernel.org/stable/c/6ff2243d5e05a5239e39d4ba61d96b0ea3bf7259
- https://git.kernel.org/stable/c/768f25613a9fe6766d15a4a72979657adfc1c6d8
- https://git.kernel.org/stable/c/a75281626fc8fa6dc6c9cc314ee423e8bc45203b
- https://git.kernel.org/stable/c/d97fc1b29513010b60fde874c7f0ba816744e18c