Executive brief
A vulnerability exists in the Linux kernel driver for Realtek RTL8723BS Wi-Fi chips. An attacker with local access to the system could exploit this flaw to cause a system crash or denial of service. This affects the stability of devices using this specific wireless hardware, potentially disrupting operations or requiring a manual reboot.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's staging driver for the Realtek RTL8723BS wireless chipset. The flaw is located in the 'rtw_get_ie_ex()' function within 'drivers/staging/rtl8723bs/core/rtw_ieee80211.c'. The parser fails to properly validate the length of Information Elements (IE) within a frame before performing memory operations like 'memcpy' or 'memcmp'. A local attacker can provide a specially crafted frame with a malicious length field to trigger a read beyond the allocated buffer. This can lead to a kernel oops or system crash (Denial of Service). Patches have been released across multiple stable kernel branches to enforce proper bounds checking.
Affected products
- Linux Linux Kernel 4.12 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-02-23: patched: Initial patch authored by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/35969c3a208a07cb8642301df5869c34e2db7071
- https://git.kernel.org/stable/c/6d62fa548387e159a21ea95132c09bfc96d336ed
- https://git.kernel.org/stable/c/740bca8bbdb707c0e4bb11e3316deb2f04fc7ce1
- https://git.kernel.org/stable/c/8097a48c606a9306281ea7bd73bf2afc97553733
- https://git.kernel.org/stable/c/821f7d759fb2de33c5e5b0c4981181c4d0c3e9b1
- https://git.kernel.org/stable/c/9a4cd4c37593cc8b8d28f9a6732b490a8032006a
- https://git.kernel.org/stable/c/ac38856092b4c994f94343251b30520bdeb7f475