staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74651
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 16:16:38 UTC
Updated2026-08-22 16:16:38 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE. The function locates a vendor-specific IE (EID 221) with rtw_get_ie() and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte version word at pbuf + 6. Those accesses require the IE body to be at least 6 bytes, but rtw_get_ie() only guarantees that the element fits within the buffer; it does not enforce a minimum body length. A vendor-specific IE whose length byte is 0 to 5, placed at the end of the buffer, therefore makes these reads run past the end of the IE and past the end of the buffer itself. The buffer holds information elements taken from received management frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which is kmemdup'd to its exact length, so the read can run off the end of the allocation. The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and rtw_get_wps_ie() in this file already reject too-short vendor-specific IEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in line with them, and needs a minimum of 6 rather than 4 bytes because of the version word. Add the missing length check.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 4fc459c5cd8767ca4d9bf2f7becbd562639ba4d9 git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b b45be82387bf759931acdd21ca7dfe740f16eb97 git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b c9068f82a0906b29c905e8788edb62c3208c7c8a git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 0d19f0600fbb610c42f2a86f95c35706dc04691b git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 42c5a0d454aa5b54fec17162d9a1f8c30f8af45a git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b e167a38a8a8f50f137721fef1a1fbba0f4588b5d git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 01ab275f8f3e497a13ebbe4ded44ec0623bccde3 git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 1c3e23e78862493e8cf1adad02b10ffcb8b9921c git Not specified
CNA Linux Linux affected 4.12 Not specified
CNA Linux Linux unaffected 4.12 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.152 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.104 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/b45be82387bf759931acdd21ca7dfe740f16eb97 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0d19f0600fbb610c42f2a86f95c35706dc04691b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e167a38a8a8f50f137721fef1a1fbba0f4588b5d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4fc459c5cd8767ca4d9bf2f7becbd562639ba4d9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/42c5a0d454aa5b54fec17162d9a1f8c30f8af45a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c9068f82a0906b29c905e8788edb62c3208c7c8a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1c3e23e78862493e8cf1adad02b10ffcb8b9921c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/01ab275f8f3e497a13ebbe4ded44ec0623bccde3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report