Description
In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths

issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management
xmit_frame together with its xmit_buf from the driver's fixed-size
management-TX pools via alloc_mgtxmitframe(). On the normal path the frame
is handed to dump_mgntframe(), which transfers ownership and eventually
returns both objects to their pools (the frame and, for beacons, the buf
in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion
path).

Several error/edge paths return early after a successful
alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never
transferred and neither object is freed:

- issue_beacon(): beacon larger than 512 bytes
- issue_probersp(): cur_network->ie_length > MAX_IE_SZ
- issue_probersp(): kzalloc() of the SSID scratch buffer fails
- issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP

Because alloc_mgtxmitframe() removes the frame and buf from their free
lists (list_del_init) without placing them on any pending list, an
orphaned pair is on no list and referenced by nobody, so it is only
reclaimed at driver teardown. Repeated hits progressively exhaust the
management-TX pools until alloc_mgtxmitframe() returns NULL and the
interface can no longer send beacons or probe/assoc responses.

Free the frame and buffer on these paths, matching the existing correct
error handling in issue_assocreq().
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a memory leak in the rtl8723bs driver of the Linux kernel. When certain management frames trigger error paths, allocated transmission frames and buffers are not returned to the free pool, leading to progressively exhausted resources. This exhaustion disables the interface’s ability to send beacons and probe responses, effectively disconnecting clients and rendering the Wi‑Fi interface unusable. The weakness is a resource‑management flaw that meets the description of CWE‑772.

Affected Systems

Any system running a Linux kernel that includes the rtl8723bs driver within its staging area is affected. No specific kernel version is listed in the advisory, so all builds that contain the unpatched driver are potentially vulnerable.

Risk and Exploitability

The flaw has no public exploitation evidence and is not listed in the CISA KEV catalog. The EPSS score is unavailable. An attacker would need to craft and transmit specific wireless management frames that trigger the edge error paths, which requires wireless proximity or control over the target device’s radio. While the probability of widespread exploitation is low, the impact—complete denial of Wi‑Fi service—remains high once the pools are exhausted.

Generated by OpenCVE AI on September 25, 2026 at 17:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a kernel update that includes the rtl8723bs driver patch that frees frames and buffers on error paths
  • If the device does not require the rtl8723bs driver for its workload, disable or unload the driver to avoid the leak
  • Monitor Wi‑Fi interface for sudden loss of beacon or probe transmission and take remedial action if performance degrades

Generated by OpenCVE AI on September 25, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772

Fri, 25 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from the driver's fixed-size management-TX pools via alloc_mgtxmitframe(). On the normal path the frame is handed to dump_mgntframe(), which transfers ownership and eventually returns both objects to their pools (the frame and, for beacons, the buf in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion path). Several error/edge paths return early after a successful alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never transferred and neither object is freed: - issue_beacon(): beacon larger than 512 bytes - issue_probersp(): cur_network->ie_length > MAX_IE_SZ - issue_probersp(): kzalloc() of the SSID scratch buffer fails - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP Because alloc_mgtxmitframe() removes the frame and buf from their free lists (list_del_init) without placing them on any pending list, an orphaned pair is on no list and referenced by nobody, so it is only reclaimed at driver teardown. Repeated hits progressively exhaust the management-TX pools until alloc_mgtxmitframe() returns NULL and the interface can no longer send beacons or probe/assoc responses. Free the frame and buffer on these paths, matching the existing correct error handling in issue_assocreq().
Title staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T13:06:48.057Z

Reserved: 2026-09-25T10:25:14.456Z

Link: CVE-2026-100076

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T14:17:14.440

Modified: 2026-09-25T14:17:14.440

Link: CVE-2026-100076

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T17:30:16Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime