Linux rtl8723bs CVE-2026-100076

Requires a Linux system using the rtl8723bs staging WiFi driver operating in a mode that issues management frames (beaconing/AP, probe-response, or assoc-response handling), plus local low-privilege access to repeatedly trigger one of the specific uncovered error paths: a beacon larger than 512 bytes in issue_beacon(), cur_network->ie_length exceeding MAX_IE_SZ in issue_probersp(), failure of the SSID scratch-buffer kzalloc() in issue_probersp(), or an assoc-response pkt_type that is neither ASSOCRSP nor REASSOCRSP in issue_asocrsp(). Limiting factors: exploitation is local only (AV:L), needs some privilege (PR:L) to drive the wireless configuration, depends on the niche Realtek rtl8723bs hardware being present, and impact is bounded to denial of wireless management transmission (A:H) with no confidentiality or integrity effect.

This is a low-to-moderate priority issue despite its MEDIUM CVSS (5.5). The supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly scopes it as a local, low-privilege, availability-only defect - a kernel memory leak (CWE-401) in the rtl8723bs staging WiFi driver that progressively exhausts the fixed-size management-TX pools until the interface can no longer send beacons or probe/assoc responses. All signals point the same direction and low: EPSS is 0.15% (4th percentile), it is NOT in CISA KEV, and no public exploit code is identified - exploitation status is 'no public exploit identified at time of analysis'. There is no confidentiality or integrity impact (C:N/I:N), so this is a localized denial-of-service of wireless management, not a code-execution or data-exposure flaw. CONFLICT TO NOTE: the input Tags label this 'Information Disclosure', which contradicts both CWE-401 (missing memory release) and the CVSS impact profile (C:N/I:N/A:H); this is purely an availability/resource-exhaustion bug, not information disclosure. The low real-world risk is further bounded by the fact that triggering requires the device to be actively issuing management frames and to repeatedly hit specific error paths - not a casual remote condition.

An attacker or fault condition on a Linux device using the rtl8723bs driver in an AP/beaconing or management-frame-sending mode repeatedly drives one of the uncovered error paths (e.g. an oversized beacon or an over-length IE), each time orphaning an xmit_frame/xmit_buf pair. After enough iterations the management-TX pools are drained and alloc_mgtxmitframe() returns NULL, leaving the interface unable to transmit beacons or probe/assoc responses until the driver is torn down. No public proof-of-concept exists, and the local attack vector (AV:L) plus low-privilege requirement (PR:L) further constrain who can trigger it.