CVE-2025-68254

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68254", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.266Z", "datePublished": "2025-12-16T14:44:57.204Z", "dateUpdated": "2026-08-05T12:10:29.074Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:29.074Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing\n\nThe Extended Supported Rates (ESR) IE handling in OnBeacon accessed\n*(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these\noffsets lie within the received frame buffer. A malformed beacon with\nan ESR IE positioned at the end of the buffer could cause an\nout-of-bounds read, potentially triggering a kernel panic.\n\nAdd a boundary check to ensure that the ESR IE body and the subsequent\nbytes are within the limits of the frame before attempting to access\nthem.\n\nThis prevents OOB reads caused by malformed beacon frames."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - A nearby attacker can inject a malformed 802.11 beacon; scan mode accepts foreign BSSIDs, and connected mode is reachable by spoofing the associated BSSID.\nAC:L - The attacker only needs to place an ESR IE ending in 0x2D at the frame boundary. No race or condition outside the attacker\u2019s control is required.\nPR:N - Beacons are unauthenticated broadcast management frames processed before association-state filtering, with no capability or credential check.\nUI:N - No victim action is required once the affected wireless interface is operating; injected beacons are processed automatically.\nS:U - The vulnerable driver and resulting kernel impacts remain within the host kernel\u2019s security authority.\nC:L - The invalid access is strictly limited to one byte immediately beyond the logical frame, potentially sampling skb tail data but not providing an arbitrary-read primitive.\nI:N - There is no out-of-bounds write; the only write decrements the length field inside the attacker-supplied receive frame.\nA:H - The kernel CNA description identifies a potential kernel panic from the invalid read. An attacker can repeatedly transmit malformed beacons to sustain denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"], "versions": [{"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "c03cb111628924827351e19baa5b073e9b0d723d", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "bb5940193d813449540d8d3a82abc045be41f48a", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "c173ce97d3f0f0c0fefa39139d6d04ba60b5db22", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "d1ab7f9cee22e7b8a528da9ac953e4193b96cda5", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "38292407c2bb5b2b3131aaace4ecc7a829b40b76", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "bf323db1d883c209880bd92f3b12503e3531c3fc", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "502ddcc405b69fa92e0add6c1714d654504f6fd7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.198", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.160", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.120", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.62", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.12", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.1", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.15.198"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.1.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.62"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.17.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c03cb111628924827351e19baa5b073e9b0d723d"}, {"url": "https://git.kernel.org/stable/c/bb5940193d813449540d8d3a82abc045be41f48a"}, {"url": "https://git.kernel.org/stable/c/c173ce97d3f0f0c0fefa39139d6d04ba60b5db22"}, {"url": "https://git.kernel.org/stable/c/d1ab7f9cee22e7b8a528da9ac953e4193b96cda5"}, {"url": "https://git.kernel.org/stable/c/38292407c2bb5b2b3131aaace4ecc7a829b40b76"}, {"url": "https://git.kernel.org/stable/c/bf323db1d883c209880bd92f3b12503e3531c3fc"}, {"url": "https://git.kernel.org/stable/c/502ddcc405b69fa92e0add6c1714d654504f6fd7"}], "title": "staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c03cb111628924827351e19baa5b073e9b0d723d", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "bb5940193d813449540d8d3a82abc045be41f48a", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "c173ce97d3f0f0c0fefa39139d6d04ba60b5db22", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "d1ab7f9cee22e7b8a528da9ac953e4193b96cda5", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "38292407c2bb5b2b3131aaace4ecc7a829b40b76", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "bf323db1d883c209880bd92f3b12503e3531c3fc", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "502ddcc405b69fa92e0add6c1714d654504f6fd7", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.198", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.160", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.120", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.62", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.12", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing\n\nThe Extended Supported Rates (ESR) IE handling in OnBeacon accessed\n*(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these\noffsets lie within the received frame buffer. A malformed beacon with\nan ESR IE positioned at the end of the buffer could cause an\nout-of-bounds read, potentially triggering a kernel panic.\n\nAdd a boundary check to ensure that the ESR IE body and the subsequent\nbytes are within the limits of the frame before attempting to access\nthem.\n\nThis prevents OOB reads caused by malformed beacon frames."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nstaging: rtl8723bs: correcci\u00f3n de lectura fuera de l\u00edmites en el an\u00e1lisis de IE ESR de OnBeacon\n\nEl manejo del IE de Tasas Soportadas Extendidas (ESR) en OnBeacon acced\u00eda a *(p + 1 + ielen) y *(p + 2 + ielen) sin verificar que estos desplazamientos se encontraran dentro del b\u00fafer de trama recibido. Una baliza malformada con un IE ESR posicionado al final del b\u00fafer podr\u00eda causar una lectura fuera de l\u00edmites, lo que podr\u00eda desencadenar un p\u00e1nico del kernel.\n\nSe a\u00f1ade una comprobaci\u00f3n de l\u00edmites para asegurar que el cuerpo del IE ESR y los bytes subsiguientes est\u00e9n dentro de los l\u00edmites de la trama antes de intentar acceder a ellos.\n\nEsto previene lecturas fuera de l\u00edmites causadas por tramas de baliza malformadas."}], "id": "CVE-2025-68254", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-12-16T15:15:54.767", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/38292407c2bb5b2b3131aaace4ecc7a829b40b76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/502ddcc405b69fa92e0add6c1714d654504f6fd7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bb5940193d813449540d8d3a82abc045be41f48a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf323db1d883c209880bd92f3b12503e3531c3fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c03cb111628924827351e19baa5b073e9b0d723d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c173ce97d3f0f0c0fefa39139d6d04ba60b5db22"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1ab7f9cee22e7b8a528da9ac953e4193b96cda5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing", "id": "2422767", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422767"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2025-68254", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68254\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68254\nhttps://lore.kernel.org/linux-cve-announce/2025121610-CVE-2025-68254-b745@gregkh/T"], "threat_severity": "Moderate"}

{}