Linux Kernel CVE-2025-68255

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow.

Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow.

This prevents kernel stack corruption triggered by malformed association requests.

The affected product is the Linux kernel, specifically the drivers/staging/rtl8723bs Realtek RTL8723BS SDIO Wi-Fi driver, in versions prior to those containing the fix. No CPE strings or explicit version ranges were provided in the input; affected version boundaries should be derived from the eight stable-tree fix commits at git.kernel.org (e.g. https://git.kernel.org/stable/c/25411f5fcf5743131158f337c99c2bbf3f8477f5 and https://git.kernel.org/stable/c/e841d8ea722315b781c4fc5bf4f7670fbca88875), which indicate the fix was backported across multiple stable series. Any distribution or device kernel that builds and loads the rtl8723bs module and processes inbound association frames is potentially affected.