Executive brief
A vulnerability was identified in the Linux kernel's Realtek RTL8723BS Wi-Fi driver. A malicious wireless access point could send specially crafted network frames to trigger an out-of-bounds memory read on a connected device. This could potentially lead to system instability or information disclosure for users of devices utilizing this specific Wi-Fi hardware.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the drivers/staging/rtl8723bs/core/rtw_mlme_ext.c component of the Linux kernel. The functions issue_assocreq() and join_cmd_hdl() fail to perform adequate bounds checking when iterating through Information Element (IE) loops. Specifically, if a malicious Access Point (AP) sends a beacon or probe-response frame where the final IE is truncated (containing an element_id but no length byte), the driver dereferences pIE->length beyond the allocated buffer. The fix implements a two-guard pattern to ensure sufficient bytes remain for the IE header and that the declared IE length does not exceed the buffer boundaries.
Affected products
- Linux Linux Kernel 554c0a3abf21 to 6.10.y
Timeline
- 2026-05-22: disclosed: Initial patch submitted by Alexandru Hossu
- 2026-07-18: patched: Patch committed to stable tree
- 2026-07-25: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/402f13ec95945f34a210b28df1f8740d3d4a58c5
- https://git.kernel.org/stable/c/4c21eec80cf502d9ea18e0b946246b2376452786
- https://git.kernel.org/stable/c/605ebd94d0f469204f3c9f2f84acc71e43e2780f
- https://git.kernel.org/stable/c/a830bdc82461353bf7b1f8a2ad2689bf5d2de444
- https://git.kernel.org/stable/c/ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e
- https://git.kernel.org/stable/c/bc881c9915c4468747d0ca5fd1abd7b313cfb0f4
- https://git.kernel.org/stable/c/c38d16b1ffac385c9e4b38447cd5c46af1114b58