EUVD-2026-64585
GHSA-m738-m8ph-wwcp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Monitor mode frame injection requires local kernel access and CAP_NET_RAW (PR:L, AV:L); kernel heap over-read and address write corruption justify C:H/I:H/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: validate monitor transmit frame lengths
rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains.
The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes.
Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.
AnalysisAI
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All three of the following conditions must be satisfied: (1) the target system must have Realtek RTL8723BS WiFi hardware present and the rtl8723bs staging kernel module actively loaded - systems without this chipset or with the module absent are completely unexposed; (2) the attacker must have local system access with CAP_NET_RAW capability (or equivalent, such as membership in a group granted raw socket access), corresponding to the PR:L CVSS metric - remote unauthenticated exploitation is not possible given AV:L; (3) a monitor-mode 802.11 interface must be active or the attacker must be able to create one, as the vulnerable code path is only reached via the cfg80211 monitor interface transmit entry. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 High score with AV:L/AC:L/PR:L/UI:N accurately reflects a kernel-space memory safety flaw that nevertheless demands local access and at minimum CAP_NET_RAW or equivalent capability to exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with CAP_NET_RAW capability places the RTL8723BS-backed interface into monitor mode, then injects a crafted skb shorter than the minimum 802.11 MAC header length (24 bytes) or a data frame with a calculated header span exceeding the actual skb length. The driver reads beyond the buffer boundary in kernel space, potentially leaking adjacent heap contents or corrupting the target of an Ethernet address write, which could facilitate privilege escalation or trigger a kernel panic. … |
| Remediation | Upgrade to a patched kernel release on your active stable branch: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running the Realtek RTL8723BS WiFi driver by scanning hardware identifiers and current Linux kernel versions to establish baseline exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today