Executive brief
The Linux kernel's rtl8723bs WiFi driver contains a vulnerability in its handling of wireless management frames. A remote attacker can send a specially crafted frame that is shorter than expected, causing the driver to read memory outside the allocated buffer. This can lead to kernel information disclosure or a crash, affecting systems using this WiFi driver.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the rtw_action_frame_parse() function within the rtl8723bs WiFi driver. The function accepts a frame_len parameter but fails to validate it before dereferencing frame_body, which is offset 24 bytes into the frame buffer. Reading frame_body[0] and frame_body[1] requires frame_len to be at least 26 bytes; a malformed frame of exactly 24 bytes triggers a 1–2 byte OOB read. The vulnerable path is reachable from user-controlled frame buffers passed via rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c. A remote attacker can exploit this by sending a crafted management frame, potentially leaking kernel memory or causing a crash. The fix adds a length check before frame_body is accessed.
Affected products
- Linux Linux kernel all versions with rtl8723bs staging driver
Timeline
- 2026-09-16: disclosed: CVE-2026-90017 published
- 2026-09-14: patched: Fix committed by Greg Kroah-Hartman