Executive brief
A vulnerability in the Linux kernel's Realtek RTL8723BS Wi-Fi driver could allow a local system crash. The issue occurs when the system fails to check if memory was successfully allocated before trying to use it. If the system is low on memory, this could lead to a 'NULL pointer dereference,' resulting in a kernel panic or system instability.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel staging driver for Realtek RTL8723BS devices (rtl8723bs). The root cause is located in the rtw_cbuf_alloc function within drivers/staging/rtl8723bs/os_dep/osdep_service.c, where the return value of kzalloc_flex() is dereferenced without a NULL check. An attacker or a system under high memory pressure could trigger this condition, leading to a kernel oops or denial of service. The vulnerability was introduced by a previous commit that replaced rtw_zmalloc() with kzalloc(). Patches have been merged into the stable kernel tree to guard the access to the allocated structure.
Affected products
- Linux Linux Kernel rtl8723bs driver
Timeline
- 2026-04-14: disclosed: Initial patch submitted by developer
- 2026-05-14: patched: Patch committed to stable kernel tree
- 2026-06-08: advisory: CVE published