Executive brief
The Linux kernel's RTL8723BS WiFi driver contains a buffer reading vulnerability in its WMM information element parsing function. When processing maliciously-crafted WiFi association or scan data from an attacker, the kernel reads one byte beyond an allocated buffer, potentially exposing sensitive memory. An attacker on a nearby network could trigger this to leak kernel memory or cause a system crash.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the rtw_restruct_wmm_ie() function in drivers/staging/rtl8723bs/core/rtw_mlme.c. When scanning for a WMM IE element in an association/scan data buffer, the code checks if a potential match exists within 5 bytes of the buffer end ("i + 5 < in_len"), but then unconditionally advances to the next IE element by reading in_ie[i + 1] regardless of whether i is near the buffer boundary. If i equals in_len - 1 (one byte from the end), the code performs a 1-byte OOB read. The vulnerability exists in the non-matching path—when the WMM IE is not found. Attack vector is network-based (attacker sends crafted WiFi frames); no authentication is required. The fix adds an explicit bounds check ("if (i + 1 >= in_len) break;") before the fallthrough advance. Patches are available in kernel commit 28a289beaf226b30b1e6e7d7b1a2946fe2d6e852 and have been backported to stable branches.
Affected products
- Linux Linux kernel multiple versions (staging/rtl8723bs driver)
Timeline
- 2026-09-16: disclosed: CVE-2026-90016 published
- 2026-09-01: patched: Fix merged into Linux kernel stable tree (commit 28a289beaf226b30b1e6e7d7b1a2946fe2d6e852)
- 2026-07-28: other: Patch authored by Muhammad Bilal