CVE-2026-98160

The Linux kernel staging driver for the Realtek RTL8723BS wireless chipset allocates the HalData structure with vzalloc but frees it with kfree in an error path of rtw_sdio_if1_init(). Using kfree on vmalloc‑backed memory corrupts kernel heap, which can lead to arbitrary code execution or a kernel panic, thereby compromising system availability and integrity. Based on the description, it is inferred that an attacker would need to trigger the driver’s initialization failure, for example by manipulating the SDIO interface or firmware, to exploit this flaw.

The flaw resides in the rtl8723bs driver that ships with the mainline Linux kernel. Any kernel build that includes this staging driver and enables RTL8723BS SDIO hardware is potentially vulnerable; the issue existed across any release prior to the applied patch.

The CVSS score of 5.5 indicates moderate severity while the EPSS score of < 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Nevertheless, an attacker who can trigger the driver’s initialization failure can cause memory corruption. The vendor fix replaces the incorrect kfree call with rtw_hal_data_deinit() that uses vfree, restoring proper memory management.