Linux Kernel CVE-2026-53179

Exploitation requires the target to be running the rtl8723bs staging driver - actual Realtek RTL8723BS SDIO Wi-Fi hardware must be present and the module loaded, which is the primary limiting factor and is not a default on most servers or enterprise endpoints. The CVSS vector (AV:L/PR:L/UI:N) indicates a local, low-privileged trigger with no user interaction and no network-service exposure. The over-read fires specifically in rtw_update_protection() when it processes an IE buffer using the full ie_length against an already-offset pointer, so the condition is reached during 802.11 IE/protection-element handling. Limiting factors: requires the specific chipset/driver, requires local access (PR:L), and impact is bounded to disclosure of adjacent kernel memory and a possible driver crash rather than code execution.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:H, base 7.1) frames this as a locally-triggered issue yielding kernel memory disclosure and potential denial of service, with no integrity impact - consistent with an over-read. Real-world urgency is low: EPSS is only 0.17% (7th percentile), the CVE is not in CISA KEV, no POC is referenced, and the vulnerable code is a staging driver requiring the specific Realtek RTL8723BS hardware to be present and active. One caveat to verify: because rtw_update_protection() parses IEs that in a station driver typically originate from received Wi-Fi frames (beacons/probe/assoc responses), a malicious access point or crafted frame could plausibly make this adjacent-network (AV:A) rather than purely local - the NVD AV:L rating should be confirmed against the actual call path. No SSVC decision data was supplied. Overall this is a low-priority kernel hardening fix rather than an actively exploited threat.

On a device using the RTL8723BS Wi-Fi chipset, an attacker with local low-privileged access (or, if the call path is reached via received frames, a nearby rogue access point) causes the driver to parse crafted information elements. rtw_update_protection() then reads past the IE buffer, leaking adjacent kernel memory or crashing the driver. No public exploit is currently identified, and success depends on the target actually running the staging rtl8723bs driver.