Skip to main content

rtl8723bs CVE-2026-53178

| EUVDEUVD-2026-39269 HIGH
Integer Underflow (CWE-191)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-c9gv-4j5c-v56g
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
8.1 HIGH

Adjacent radio delivery (AV:A) of a crafted management frame, no auth or interaction (PR:N/UI:N), unsigned underflow yields OOB read enabling kernel memory leak (C:H) and crash (A:H), no integrity impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat
MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:22 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.1 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction

Add guards to ensure ie_length is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow.

AnalysisAI

Memory-safety flaw in the Linux kernel's staging rtl8723bs Realtek SDIO Wi-Fi driver allows an adjacent (radio-range) attacker to trigger an unsigned-integer underflow in the rtw_mlme information-element parsing path, leading to out-of-bounds reads that can disclose kernel memory or crash the system. The bug occurs because ie_length was not validated before fixed IE offsets were subtracted from it. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, but a vendor (upstream kernel) fix is available.

Technical ContextAI

The affected component is the rtl8723bs driver, a staging-tree Linux kernel driver for Realtek RTL8723BS SDIO 802.11n Wi-Fi chips commonly found in low-cost tablets, single-board computers, and embedded devices. The defect lives in rtw_mlme, the MLME (MAC sublayer management entity) code that parses 802.11 management-frame Information Elements (IEs). When the code subtracts fixed IE header offsets from ie_length without first confirming ie_length is at least that large, the unsigned subtraction wraps around to a very large value, causing subsequent length-driven reads/loops to access memory beyond the frame buffer. No CWE was assigned in the input, but the root cause class is an integer underflow (CWE-191) leading to an out-of-bounds read (CWE-125).

RemediationAI

Apply the upstream kernel fix: update to a stable kernel containing commits 542d65a6dbd9733baab96313c9fe76a76e93f484 and 88e994c57a79f62d5338231d8d37ee8dd98baffe (the patch series identified as 7.0.13 and 7.1), available via https://git.kernel.org/stable/c/542d65a6dbd9733baab96313c9fe76a76e93f484 and https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe; on distribution kernels, install the vendor's updated stable kernel package. Where immediate patching is not possible, the most effective compensating control is to unload/blacklist the rtl8723bs module if the RTL8723BS Wi-Fi chip is not needed (trade-off: disables Wi-Fi on devices that rely on this chipset), or disable the wireless interface and prefer wired/alternate connectivity. Because the attack vector is adjacent (Wi-Fi), operating affected devices only on trusted, controlled RF environments and away from untrusted access points/clients reduces exposure, though this does not eliminate the flaw.

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

Share

CVE-2026-53178 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy