CVE-2026-74650

staging: rtl8723bs: fix OOB read in WMM_param_handler()

Published Aug 22, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in WMM_param_handler()

WMM_param_handler() copies a fixed-size WMM parameter element out of a
received information element without checking that the element is long
enough, causing an out-of-bounds read for a short WMM IE.

The handler reads sizeof(struct WMM_para_element) (18) bytes at
pIE->data + 6, so it requires pIE->length to be at least 24
(WLAN_WMM_LEN), but it never validates the length. Two of its three
callers reach it after matching only the WMM OUI: OnAssocRsp() in
rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a
4-byte OUI, before calling the handler. A vendor-specific IE carrying
the WMM OUI but a length between 6 and 23, placed in an association
response or in the IE blob handed to join_cmd_hdl(), passes the OUI
check and then makes the memcmp() and memcpy() at pIE->data + 6 read
past the end of the element. OnAssocRsp() parses a frame received from
the AP, so this is reachable from a remote peer.

The remaining caller in rtw_wlan_util.c already guards the handler with
"pIE->length == WLAN_WMM_LEN". Move the equivalent check into the
handler itself so every caller is covered; the sibling IE handlers in
the same parsing loop (HT_caps_handler(), HT_info_handler(),
ERP_IE_handler()) likewise bound their accesses by pIE->length.

Analysis

Technical impact

The rtl8723bs driver in the Linux kernel contains an out‑of‑bounds read in WMM_param_handler(). The function copies 18 bytes from an incoming WMM information element without verifying that the element length is at least 24 bytes. A malicious 802.11 access point can send an association response or a vendor‑specific IE with a short WMM element that passes a 6‑byte OUI check but fails the length check, causing the kernel to read past the end of the element. This silent read can leak kernel memory contents or, if triggered repeatedly, lead to a crash. The vulnerability is reachable from a remote peer via a crafted authentication or join frame.

Affected Systems

All Linux kernel builds that include the rtl8723bs wireless driver before the commit that adds the length check. The issue affects the staging driver for the RTL8723BS chipset, which is used by a variety of laptop and embedded devices running recent Linux distributions that ship the generic kernel.

Risk and Exploitability

Because the flaw is triggered by a frame that an attacker can send from a rogue access point, the attack surface is remote. The EPSS score is very low (<1%) and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 5.5 indicates a medium severity, yet the out‑of‑bounds read can leak kernel memory or trigger a crash. The lack of a length guard in multiple callers means any instance that parses the WMM IE is vulnerable until the upstream patch is applied.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 5df2fd06567df5f178c8faae0bdaefd203618d21
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 2bee6f7a0f0125238951e31da2e96d06fe359043
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 1158b9931207392d6dd136aa0c4be18893b50fa1
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< ce2399717de242344880044b91a20a712644fdfb
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< e5b7610008f4e6a80c8b071aa77ddbd5e17ea472
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< ae21407350151bddfd4fea7aa39bd0643c0ca9d3

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`5.10.267`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,2bee6f7a0f0125238951e31da2e96d06fe359043)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,1158b9931207392d6dd136aa0c4be18893b50fa1)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,ce2399717de242344880044b91a20a712644fdfb)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,e5b7610008f4e6a80c8b071aa77ddbd5e17ea472)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,ae21407350151bddfd4fea7aa39bd0643c0ca9d3)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.12`	affected	generic	—
`[0,4.12)`	unaffected	generic	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the rtl8723bs OOB read fix (e.g., kernel 6.6 or newer).
If a kernel update is unavailable, disable the rtl8723bs driver or block Wi‑Fi interfaces to prevent association attempts that could trigger the handler.
Configure the wireless subsystem to reject or strip vendor‑specific WMM IEs with lengths below the required 24 bytes, ensuring only properly formed frames are processed.

Generated by OpenCVE AI on August 24, 2026 at 20:14 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.177% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/1158b9931207392d6dd136aa0c4be18893b50fa1
https://git.kernel.org/stable/c/2bee6f7a0f0125238951e31da2e96d06fe359043
https://git.kernel.org/stable/c/5df2fd06567df5f178c8faae0bdaefd203618d21
https://git.kernel.org/stable/c/6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93
https://git.kernel.org/stable/c/ae21407350151bddfd4fea7aa39bd0643c0ca9d3
https://git.kernel.org/stable/c/ce2399717de242344880044b91a20a712644fdfb
https://git.kernel.org/stable/c/e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4
https://git.kernel.org/stable/c/e5b7610008f4e6a80c8b071aa77ddbd5e17ea472
https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74650-516c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74650
https://www.cve.org/CVERecord?id=CVE-2026-74650

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 27, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5df2fd06567df5f178c8faae0bdaefd203618d21

Aug 24, 2026 2:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-200

Aug 24, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74650-516c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74650 https://www.cve.org/CVERecord?id=CVE-2026-74650
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Aug 22, 2026 5:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-200

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMM_param_handler() WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE. The handler reads sizeof(struct WMM_para_element) (18) bytes at pIE->data + 6, so it requires pIE->length to be at least 24 (WLAN_WMM_LEN), but it never validates the length. Two of its three callers reach it after matching only the WMM OUI: OnAssocRsp() in rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a 4-byte OUI, before calling the handler. A vendor-specific IE carrying the WMM OUI but a length between 6 and 23, placed in an association response or in the IE blob handed to join_cmd_hdl(), passes the OUI check and then makes the memcmp() and memcpy() at pIE->data + 6 read past the end of the element. OnAssocRsp() parses a frame received from the AP, so this is reachable from a remote peer. The remaining caller in rtw_wlan_util.c already guards the handler with "pIE->length == WLAN_WMM_LEN". Move the equivalent check into the handler itself so every caller is covered; the sibling IE handlers in the same parsing loop (HT_caps_handler(), HT_info_handler(), ERP_IE_handler()) likewise bound their accesses by pIE->length.
Title		staging: rtl8723bs: fix OOB read in WMM_param_handler()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1158b9931207392d6dd136aa0c4be18893b50fa1 https://git.kernel.org/stable/c/2bee6f7a0f0125238951e31da2e96d06fe359043 https://git.kernel.org/stable/c/6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93 https://git.kernel.org/stable/c/ae21407350151bddfd4fea7aa39bd0643c0ca9d3 https://git.kernel.org/stable/c/ce2399717de242344880044b91a20a712644fdfb https://git.kernel.org/stable/c/e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4 https://git.kernel.org/stable/c/e5b7610008f4e6a80c8b071aa77ddbd5e17ea472