Description
In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in WMM_param_handler()

WMM_param_handler() copies a fixed-size WMM parameter element out of a
received information element without checking that the element is long
enough, causing an out-of-bounds read for a short WMM IE.

The handler reads sizeof(struct WMM_para_element) (18) bytes at
pIE->data + 6, so it requires pIE->length to be at least 24
(WLAN_WMM_LEN), but it never validates the length. Two of its three
callers reach it after matching only the WMM OUI: OnAssocRsp() in
rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a
4-byte OUI, before calling the handler. A vendor-specific IE carrying
the WMM OUI but a length between 6 and 23, placed in an association
response or in the IE blob handed to join_cmd_hdl(), passes the OUI
check and then makes the memcmp() and memcpy() at pIE->data + 6 read
past the end of the element. OnAssocRsp() parses a frame received from
the AP, so this is reachable from a remote peer.

The remaining caller in rtw_wlan_util.c already guards the handler with
"pIE->length == WLAN_WMM_LEN". Move the equivalent check into the
handler itself so every caller is covered; the sibling IE handlers in
the same parsing loop (HT_caps_handler(), HT_info_handler(),
ERP_IE_handler()) likewise bound their accesses by pIE->length.
Published: 2026-08-22
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The rtl8723bs driver in the Linux kernel contains an out‑of‑bounds read in WMM_param_handler(). The function copies 18 bytes from an incoming WMM information element without verifying that the element length is at least 24 bytes. A malicious 802.11 access point can send an association response or a vendor‑specific IE with a short WMM element that passes a 6‑byte OUI check but fails the length check, causing the kernel to read past the end of the element. This silent read can leak kernel memory contents or, if triggered repeatedly, lead to a crash. The vulnerability is reachable from a remote peer via a crafted authentication or join frame.

Affected Systems

All Linux kernel builds that include the rtl8723bs wireless driver before the commit that adds the length check. The issue affects the staging driver for the RTL8723BS chipset, which is used by a variety of laptop and embedded devices running recent Linux distributions that ship the generic kernel.

Risk and Exploitability

Because the flaw is triggered by a frame that an attacker can send from a rogue access point, the attack surface is remote. The EPSS score is not available and the CVE is not listed in CISA’s KEV catalog, but the vulnerability resides in kernel code and can cause an out‑of‑bounded read that may lead to a denial‑of‑service crash or memory disclosure. The missing length guard applies to multiple callers, so any instance that parses the WMM IE is vulnerable until the upstream patch is applied. The severity is considered high due to the kernel context and remote triggerability.

Generated by OpenCVE AI on August 22, 2026 at 17:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a release that contains the rtl8723bs OOB read fix (e.g., kernel 6.6 or newer).
  • If a kernel update is unavailable, disable the rtl8723bs driver or block Wi‑Fi interfaces to prevent association attempts that could trigger the handler.
  • Configure the wireless subsystem to reject or strip vendor‑specific WMM IEs with lengths below the required 24 bytes, ensuring only properly formed frames are processed.

Generated by OpenCVE AI on August 22, 2026 at 17:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Sat, 22 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMM_param_handler() WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE. The handler reads sizeof(struct WMM_para_element) (18) bytes at pIE->data + 6, so it requires pIE->length to be at least 24 (WLAN_WMM_LEN), but it never validates the length. Two of its three callers reach it after matching only the WMM OUI: OnAssocRsp() in rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a 4-byte OUI, before calling the handler. A vendor-specific IE carrying the WMM OUI but a length between 6 and 23, placed in an association response or in the IE blob handed to join_cmd_hdl(), passes the OUI check and then makes the memcmp() and memcpy() at pIE->data + 6 read past the end of the element. OnAssocRsp() parses a frame received from the AP, so this is reachable from a remote peer. The remaining caller in rtw_wlan_util.c already guards the handler with "pIE->length == WLAN_WMM_LEN". Move the equivalent check into the handler itself so every caller is covered; the sibling IE handlers in the same parsing loop (HT_caps_handler(), HT_info_handler(), ERP_IE_handler()) likewise bound their accesses by pIE->length.
Title staging: rtl8723bs: fix OOB read in WMM_param_handler()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-22T15:32:26.333Z

Reserved: 2026-08-15T05:44:03.923Z

Link: CVE-2026-74650

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-22T16:16:38.413

Modified: 2026-08-22T16:16:38.413

Link: CVE-2026-74650

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T17:15:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor