Executive brief
The Linux kernel's rtl8723bs WiFi driver contains a stack buffer overflow vulnerability in its handling of WiFi Protected Setup (WPS) attributes from wireless management frames. An attacker can craft a malicious WPS beacon or probe response that, when scanned by a system, causes the parsing thread to corrupt the kernel stack, potentially leading to arbitrary code execution or system crash.
Technical details
The vulnerability exists in rtw_get_wps_attr() which parses WPS attributes from wireless frames. The function validates that the 4-byte attribute header fits within the WPS information element, but fails to validate that the variable-length attribute data (0–65535 bytes) fits as well. The unchecked attr_len value from the wire is then used directly in a memcpy() to copy into a fixed-size stack buffer (sometimes as small as a single byte), creating a stack buffer overflow. The attack vector is network-based: a crafted WPS IE in a beacon or probe response is sufficient to trigger the overflow during WiFi scanning. No authentication or user interaction is required. The overflow can corrupt the kernel stack, potentially enabling arbitrary code execution.
Affected products
- Linux Linux kernel staging/rtl8723bs driver (fixed in commit addressing this issue)
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory: CVE-2026-90018 published