Executive brief
A vulnerability was identified in the Linux kernel driver for Realtek RTL8723BS wireless network adapters. This flaw could allow a nearby attacker to cause a system crash or unpredictable behavior by sending specially crafted Wi-Fi management frames. This impacts the stability and availability of devices using this specific wireless hardware.
Technical details
An unsigned integer underflow vulnerability exists in the 'rtw_mlme.c' component of the rtl8723bs staging driver in the Linux kernel. The root cause is a lack of bounds checking on 'ie_length' before subtracting fixed offsets (_FIXED_IE_LENGTH_ and _BEACON_IE_OFFSET_). An attacker within wireless range could potentially trigger this underflow by providing malformed IEs in Wi-Fi frames, leading to out-of-bounds memory access or a kernel panic. The issue has been resolved by adding explicit length guards in the 'rtw_is_desired_network' function. Patches are available in the stable kernel trees.
Affected products
- Linux Linux Kernel 5.15 to 7.1
Timeline
- 2026-05-13: other: Vulnerability reported and patch authored
- 2026-06-25: disclosed: CVE published