CVE-2026-74650 - Vulnerability Details

- staging: rtl8723bs: fix OOB read in WMM_param_handler()

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in WMM_param_handler()

WMM_param_handler() copies a fixed-size WMM parameter element out of a
received information element without checking that the element is long
enough, causing an out-of-bounds read for a short WMM IE.

The handler reads sizeof(struct WMM_para_element) (18) bytes at
pIE->data + 6, so it requires pIE->length to be at least 24
(WLAN_WMM_LEN), but it never validates the length. Two of its three
callers reach it after matching only the WMM OUI: OnAssocRsp() in
rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a
4-byte OUI, before calling the handler. A vendor-specific IE carrying
the WMM OUI but a length between 6 and 23, placed in an association
response or in the IE blob handed to join_cmd_hdl(), passes the OUI
check and then makes the memcmp() and memcpy() at pIE->data + 6 read
past the end of the element. OnAssocRsp() parses a frame received from
the AP, so this is reachable from a remote peer.

The remaining caller in rtw_wlan_util.c already guards the handler with
"pIE->length == WLAN_WMM_LEN". Move the equivalent check into the
handler itself so every caller is covered; the sibling IE handlers in
the same parsing loop (HT_caps_handler(), HT_info_handler(),
ERP_IE_handler()) likewise bound their accesses by pIE->length.

Published: 2026-08-22

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The rtl8723bs driver in the Linux kernel contains an out‑of‑bounds read in WMM_param_handler(). The function copies 18 bytes from an incoming WMM information element without verifying that the element length is at least 24 bytes. A malicious 802.11 access point can send an association response or a vendor‑specific IE with a short WMM element that passes a 6‑byte OUI check but fails the length check, causing the kernel to read past the end of the element. This silent read can leak kernel memory contents or, if triggered repeatedly, lead to a crash. The vulnerability is reachable from a remote peer via a crafted authentication or join frame.

Affected Systems

All Linux kernel builds that include the rtl8723bs wireless driver before the commit that adds the length check. The issue affects the staging driver for the RTL8723BS chipset, which is used by a variety of laptop and embedded devices running recent Linux distributions that ship the generic kernel.

Risk and Exploitability

Because the flaw is triggered by a frame that an attacker can send from a rogue access point, the attack surface is remote. The EPSS score is very low (<1%) and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 5.5 indicates a medium severity, yet the out‑of‑bounds read can leak kernel memory or trigger a crash. The lack of a length guard in multiple callers means any instance that parses the WMM IE is vulnerable until the upstream patch is applied.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 5df2fd06567df5f178c8faae0bdaefd203618d21
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 2bee6f7a0f0125238951e31da2e96d06fe359043
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 1158b9931207392d6dd136aa0c4be18893b50fa1
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< ce2399717de242344880044b91a20a712644fdfb
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< e5b7610008f4e6a80c8b071aa77ddbd5e17ea472
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< ae21407350151bddfd4fea7aa39bd0643c0ca9d3

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`5.10.267`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,2bee6f7a0f0125238951e31da2e96d06fe359043)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,1158b9931207392d6dd136aa0c4be18893b50fa1)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,ce2399717de242344880044b91a20a712644fdfb)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,e5b7610008f4e6a80c8b071aa77ddbd5e17ea472)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,ae21407350151bddfd4fea7aa39bd0643c0ca9d3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.12`	affected	generic	—
`[0,4.12)`	unaffected	generic	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the rtl8723bs OOB read fix (e.g., kernel 6.6 or newer).
If a kernel update is unavailable, disable the rtl8723bs driver or block Wi‑Fi interfaces to prevent association attempts that could trigger the handler.
Configure the wireless subsystem to reject or strip vendor‑specific WMM IEs with lengths below the required 24 bytes, ensuring only properly formed frames are processed.

Generated by OpenCVE AI on August 24, 2026 at 20:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1158b9931207392d6dd136aa0c4be18893b50fa1
https://git.kernel.org/stable/c/2bee6f7a0f0125238951e31da2e96d06fe359043
https://git.kernel.org/stable/c/5df2fd06567df5f178c8faae0bdaefd203618d21
https://git.kernel.org/stable/c/6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93
https://git.kernel.org/stable/c/ae21407350151bddfd4fea7aa39bd0643c0ca9d3
https://git.kernel.org/stable/c/ce2399717de242344880044b91a20a712644fdfb
https://git.kernel.org/stable/c/e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4
https://git.kernel.org/stable/c/e5b7610008f4e6a80c8b071aa77ddbd5e17ea472
https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74650-516c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74650
https://www.cve.org/CVERecord?id=CVE-2026-74650

History

Thu, 27 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5df2fd06567df5f178c8faae0bdaefd203618d21

Mon, 24 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200

Mon, 24 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74650-516c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74650 https://www.cve.org/CVERecord?id=CVE-2026-74650
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 22 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMM_param_handler() WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE. The handler reads sizeof(struct WMM_para_element) (18) bytes at pIE->data + 6, so it requires pIE->length to be at least 24 (WLAN_WMM_LEN), but it never validates the length. Two of its three callers reach it after matching only the WMM OUI: OnAssocRsp() in rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a 4-byte OUI, before calling the handler. A vendor-specific IE carrying the WMM OUI but a length between 6 and 23, placed in an association response or in the IE blob handed to join_cmd_hdl(), passes the OUI check and then makes the memcmp() and memcpy() at pIE->data + 6 read past the end of the element. OnAssocRsp() parses a frame received from the AP, so this is reachable from a remote peer. The remaining caller in rtw_wlan_util.c already guards the handler with "pIE->length == WLAN_WMM_LEN". Move the equivalent check into the handler itself so every caller is covered; the sibling IE handlers in the same parsing loop (HT_caps_handler(), HT_info_handler(), ERP_IE_handler()) likewise bound their accesses by pIE->length.
Title		staging: rtl8723bs: fix OOB read in WMM_param_handler()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1158b9931207392d6dd136aa0c4be18893b50fa1 https://git.kernel.org/stable/c/2bee6f7a0f0125238951e31da2e96d06fe359043 https://git.kernel.org/stable/c/6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93 https://git.kernel.org/stable/c/ae21407350151bddfd4fea7aa39bd0643c0ca9d3 https://git.kernel.org/stable/c/ce2399717de242344880044b91a20a712644fdfb https://git.kernel.org/stable/c/e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4 https://git.kernel.org/stable/c/e5b7610008f4e6a80c8b071aa77ddbd5e17ea472

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:26.333Z

Updated: 2026-08-27T12:39:54.006Z

Reserved: 2026-08-15T05:44:03.923Z

Link: CVE-2026-74650

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:38.413

Modified: 2026-08-27T13:18:35.720

Link: CVE-2026-74650

Redhat

Severity : Moderate

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74650 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-24T20:15:04Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object