Executive brief
The RTL8723bs Wi-Fi driver in the Linux kernel fails to validate frame lengths before processing wireless monitor mode transmissions. An attacker with the ability to transmit malformed wireless frames to a monitored interface could trigger out-of-bounds memory reads or cause crashes, potentially compromising system stability or exposing sensitive kernel memory.
Technical details
The vulnerability exists in the rtw_cfg80211_monitor_if_xmit_entry() function in drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c. After removing the radiotap header from a wireless frame, the code reads the 802.11 frame control field and accesses 802.11, QoS, and SNAP header fields without first validating that the socket buffer contains sufficient data. A truncated or malformed frame can trigger out-of-bounds reads or leave insufficient data for address field writes. The fix adds length validation checks to reject frames that do not contain the complete base 802.11 header and data frames lacking their calculated header span. Attack requires ability to send frames to a monitored interface (local/adjacent network access).
Affected products
- Linux Linux kernel All versions with RTL8723bs driver (staging)
Timeline
- 2026-08-22: disclosed
- 2026-07-28: patched: Commit 6829665d050983907b560173e49dcc6c11cb2730