Skip to main content

Linux Kernel CVE-2025-68254

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI
7.1 HIGH

Adjacent radio-range attacker (AV:A) sends a low-complexity malformed beacon with no auth or interaction; primary impact is kernel panic (A:H) with minor OOB memory disclosure (C:L) and no integrity effect.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:17 vuln.today
CVE Published
Dec 16, 2025 - 15:15 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing

The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets lie within the received frame buffer. A malformed beacon with an ESR IE positioned at the end of the buffer could cause an out-of-bounds read, potentially triggering a kernel panic.

Add a boundary check to ensure that the ESR IE body and the subsequent bytes are within the limits of the frame before attempting to access them.

This prevents OOB reads caused by malformed beacon frames.

AnalysisAI

Out-of-bounds read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an adjacent attacker to trigger a kernel panic by broadcasting a malformed 802.11 beacon frame. The OnBeacon handler parses an Extended Supported Rates (ESR) information element positioned at the end of the received frame buffer without bounds validation, reading past the buffer. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%), but the flaw is remotely reachable over the air against any device using this driver.

Technical ContextAI

The affected component is the rtl8723bs driver in the Linux kernel staging tree, which supports Realtek RTL8723BS SDIO Wi-Fi chipsets common in low-cost laptops, tablets, and single-board computers. During 802.11 management-frame processing, OnBeacon walks the beacon's tagged information elements and, when handling the Extended Supported Rates IE, dereferences *(p + 1 + ielen) and *(p + 2 + ielen) to read the IE body and trailing bytes without confirming those offsets fall inside the received frame buffer. This is a classic CWE-125 out-of-bounds read: an ESR IE placed at the tail of a short frame causes the parser to read adjacent kernel memory, which can fault and panic. The root-cause CWE was listed as N/A in the source data but the description and fix (adding a boundary check) are consistent with out-of-bounds read.

Affected ProductsAI

The vulnerability affects the Linux kernel's staging rtl8723bs driver (Realtek RTL8723BS Wi-Fi) across multiple maintained branches, as indicated by seven separate stable-tree fix commits on git.kernel.org (38292407c2bb, 502ddcc405b6, bb5940193d81, bf323db1d883, c03cb1116289, c173ce97d3f0, and d1ab7f9cee22). No specific fixed kernel version tag is provided in the input, and no distribution-specific advisory is referenced; exact vulnerable version ranges must be derived from the branches these stable commits were applied to. There is no CPE string in the source data to pin exact version boundaries.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that incorporates the stable-tree commits referenced above (e.g., https://git.kernel.org/stable/c/38292407c2bb5b2b3131aaace4ecc7a829b40b76 and the six sibling commits), which add the missing boundary check on the ESR IE offsets. Because no single tagged release version is provided in the data, track the fix through your distribution's kernel security updates rather than an assumed version number. As a compensating control for unpatched systems that do not need the affected radio, blacklist or unload the rtl8723bs module (e.g., add it to modprobe blacklist or rmmod r8723bs), which fully removes the attack surface at the cost of disabling Wi-Fi on that chipset; alternatively, operate the device only in trusted RF environments or on wired networking to reduce exposure to hostile beacon frames, accepting that this does not eliminate the flaw.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-68254 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy