Executive brief
A vulnerability was identified in the Linux kernel's driver for Realtek RTL8723BS Wi-Fi chips. A malicious wireless access point could send specially crafted beacon frames that cause the driver to read data outside of its intended memory buffer. This could lead to system instability or potentially allow an attacker to gain information from the system's memory if they are within Wi-Fi range.
Technical details
An out-of-bounds (OOB) read exists in the update_beacon_info() function within the rtl8723bs staging driver (drivers/staging/rtl8723bs/core/rtw_wlan_util.c). The IE parsing loop fails to sufficiently validate the length of Information Elements against the actual frame size. Specifically, if a beacon's last IE is truncated or declares a length extending beyond the allocated buffer, the loop reads past the buffer boundary. An attacker can exploit this via a malicious Access Point (AP) sending crafted beacons. The fix introduces bounds checks to ensure both the IE header and its declared data reside within the received frame's length.
Affected products
- Linux Linux 4.12 to 6.10.1
Timeline
- 2026-05-22: other: Patch submitted by developer
- 2026-07-24: patched: Commits merged into stable branches
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25
- https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4
- https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539
- https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29
- https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907
- https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070
- https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16