Executive brief
The Linux kernel's rtl8723bs WiFi driver processes wireless information elements without proper length validation. A maliciously crafted wireless management frame with a truncated vendor-specific information element can trigger an out-of-bounds memory read, potentially exposing kernel memory or causing a system crash. This affects systems using the rtl8723bs driver for WiFi connectivity.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the rtw_get_wpa_ie() function within the rtl8723bs driver. The function reads a 4-byte OUI+type at offset pbuf+2 and a 2-byte version word at pbuf+6 without first validating that the vendor-specific information element (EID 221) body contains at least 6 bytes. The function rtw_get_ie() only guarantees the element fits within the buffer but does not enforce a minimum body length. When a vendor-specific IE with length 0–5 is placed at the end of a buffer (e.g., from a received management frame or from rtw_cfg80211_set_wpa_ie()), these reads run past the element, the buffer boundary, and potentially off the end of the allocation. The attack vector is network-based: an attacker can craft and transmit a malicious management frame. A fix adds a minimum length check (len < 6) before the OUI comparison, consistent with sibling helper functions rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_ie().
Affected products
- Linux Linux kernel all versions with rtl8723bs driver (staging drivers)
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched