Executive brief
A vulnerability was identified in the Linux kernel's driver for Realtek RTL8723BS Wi-Fi chips. This flaw could allow a nearby attacker to cause a system crash or potentially access sensitive information from the computer's memory by sending specially crafted wireless network data. The issue affects devices using this specific wireless hardware, commonly found in some laptops and tablets.
Technical details
A buffer over-read vulnerability exists in the Linux kernel staging driver for Realtek RTL8723BS (rtl8723bs). The function rtw_update_protection() in drivers/staging/rtl8723bs/core/rtw_mlme.c was being called with a pointer offset into the Information Elements (IE) buffer, but the original full length (ie_length) was passed instead of the remaining length. This discrepancy allows the function to read beyond the intended buffer boundaries. An attacker within wireless range could potentially exploit this during network updates or BSS joins to leak kernel memory or cause a denial of service. The issue has been patched by correctly calculating the remaining buffer length and adding bounds checks.
Affected products
- Linux Linux Kernel 5.15 to 6.18.36, 7.0.13
Timeline
- 2026-05-09: other: Patch authored
- 2026-06-25: disclosed: CVE published
- 2026-06-25: advisory