What is the CVSS score of CVE-2026-74648?

CVE-2026-74648 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-74648?

Within 24 hours, inventory all systems running the Realtek RTL8723BS WiFi driver by scanning hardware identifiers and current Linux kernel versions to establish baseline exposure. Within 7 days, apply the vendor-released patch through your standard patch management process, prioritizing internet-facing edge devices and high-sensitivity workstations first. Within 30 days, validate patch deployment across the entire estate by confirming driver version updates and system reboots, using kernel logging or driver info utilities to confirm the vulnerable code path is no longer present.

Linux Kernel CVE-2026-74648

Q: Which versions of Linux Kernel are affected by CVE-2026-74648?

The Realtek RTL8723BS WiFi driver vulnerability (CVE-2026-74648, CVSS 7.8) enables local attackers to read arbitrary kernel memory and destabilize Linux systems; no public exploit identified at time…. A patch is available.

EUVD-2026-64585 HIGH

2026-08-22 Linux

GHSA-m738-m8ph-wwcp

Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local access with CAP_NET_RAW
Delivery

Load or confirm rtl8723bs staging driver is present
Exploit

Activate monitor mode on the RTL8723BS interface
Execution

Inject crafted truncated 802.11 frame via monitor interface
Persist

Trigger out-of-bounds read in rtw_cfg80211_monitor_if_xmit_entry
Impact

Access or corrupt kernel memory

Vulnerability Assessment

Exploitation Conditions	All three of the following conditions must be satisfied: (1) the target system must have Realtek RTL8723BS WiFi hardware present and the rtl8723bs staging kernel module actively loaded - systems without this chipset or with the module absent are completely unexposed; (2) the attacker must have local system access with CAP_NET_RAW capability (or equivalent, such as membership in a group granted raw socket access), corresponding to the PR:L CVSS metric - remote unauthenticated exploitation is not possible given AV:L; (3) a monitor-mode 802.11 interface must be active or the attacker must be able to create one, as the vulnerable code path is only reached via the cfg80211 monitor interface transmit entry. No non-default configuration beyond the presence of the driver and monitor mode is required once these conditions are met.
Impact	The CVSS 7.8 High score with AV:L/AC:L/PR:L/UI:N accurately reflects a kernel-space memory safety flaw that nevertheless demands local access and at minimum CAP_NET_RAW or equivalent capability to exploit. Contrasting signals: EPSS at 0.22% (13th percentile) is very low, the CVE is absent from the CISA KEV catalog, and no public exploit code has been identified - suggesting this has not attracted automated or widespread exploitation tooling. The high C/I/A impact metrics are technically credible: out-of-bounds kernel heap reads risk sensitive data exposure (C:H), corrupted Ethernet address writes constitute a kernel integrity violation (I:H), and a kernel panic is a plausible outcome (A:H). Real-world priority is moderate: the attack surface is gated behind RTL8723BS hardware presence, driver load, and monitor mode activation, which collectively narrow the exposed population considerably - the staging classification of the driver means it is unlikely to be present on enterprise servers or cloud infrastructure, and even an operator running a large fleet of ARM-based edge or IoT devices should patch rather than treat this as urgent-critical. The CVSS score may overstate risk for environments without RTL8723BS hardware; defenders should confirm driver presence before prioritizing this above other pending kernel updates.
Exploit ScenarioDerived	A local user with CAP_NET_RAW capability places the RTL8723BS-backed interface into monitor mode, then injects a crafted skb shorter than the minimum 802.11 MAC header length (24 bytes) or a data frame with a calculated header span exceeding the actual skb length. The driver reads beyond the buffer boundary in kernel space, potentially leaking adjacent heap contents or corrupting the target of an Ethernet address write, which could facilitate privilege escalation or trigger a kernel panic. No public exploit code has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 25, 2026

Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.

RemediationAI

Upgrade to a patched kernel release on your active stable branch: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2. Individual stable-tree fix commits are published at https://git.kernel.org/stable/c/f03398d835f5249c49546f0eb0d0df6792b95d5f, https://git.kernel.org/stable/c/a3ac6d849de5f7abe14761d741bbb843ac793454, and six additional branch-specific commits documented in the references. As an immediate compensating control where patching cannot be applied promptly, unload the staging driver with 'modprobe -r r8723bs' and blacklist the module in /etc/modprobe.d/ - this fully eliminates the attack surface but disables all RTL8723BS WiFi functionality as a side effect. Alternatively, restrict CAP_NET_RAW access by tightening user namespace policies or using seccomp/AppArmor profiles to prevent unprivileged users from opening raw sockets; note that restricting user namespaces may impact containerized workloads. NVD advisory detail is available at https://nvd.nist.gov/vuln/detail/CVE-2026-74648.

Affected VersionsENISA

Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b <6829665d050983907b560173e49dcc6c11cb2730

Linux patch: 6.18.45

Linux patch: 7.2

Linux patch: 7.1.9

Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b <bd88f6289b7e483216a9c1df15a0460ef9b02cb6

Linux patch: 6.12.104

Linux 4.12

Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b <7b0f62d2986a28e5e4188366bc2f4e2868b14790

Linux patch: 6.1.183

Linux patch: 0

Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b <c5e5d78743992e235b76d2ebe5a403d60315aa8a

Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b <a3ac6d849de5f7abe14761d741bbb843ac793454

Linux patch: 5.15.216

Linux patch: 5.10.265

Linux patch: 6.6.152

Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b <f03398d835f5249c49546f0eb0d0df6792b95d5f

Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b <7edd3adb0c80d70b4237640275c559610f438476

Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b <8b3e4ed9c35d3d3b64fcc23f4a1f22b37c1865b1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The rtl8723bs driver is a Linux kernel staging driver for the Realtek RTL8723BS 802.11n WiFi SoC, commonly integrated into budget ARM-based tablets and single-board computers. Monitor mode allows raw 802.11 frame injection at the physical layer via a dedicated cfg80211 transmit entry point. In rtw_cfg80211_monitor_if_xmit_entry(), after stripping the variable-length radiotap header, the code reads the 802.11 MAC frame control field (FCF) to determine frame type without first checking that the skb still holds at least the 24-byte minimum 802.11 header. For data frames, the driver subsequently computes the expected header span (802.11 + optional QoS + SNAP) and calls skb_pull() on it before confirming the skb is large enough, leaving the data path able to read beyond the buffer or leave too few bytes for the subsequent Ethernet address writes. This is a classic out-of-bounds read (analogous to CWE-125) rooted in missing input validation at a protocol-layer parsing boundary - CWE was listed as N/A in source data. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* and EUVD-2026-64585 confirm the vulnerable range starts at commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Monitor mode frame injection requires local kernel access and CAP_NET_RAW (PR:L, AV:L); kernel heap over-read and address write corruption justify C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 25, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 22, 2026 - 16:01 EUVD

CVE Published

Aug 22, 2026 - 15:32 cve.org

HIGH 7.8

CVE Published

Aug 22, 2026 - 15:32 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: validate monitor transmit frame lengths

rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains.

The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes.

Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.

Executive ViewAI

Why It Matters

The Realtek RTL8723BS WiFi driver vulnerability (CVE-2026-74648, CVSS 7.8) enables local attackers to read arbitrary kernel memory and destabilize Linux systems; no public exploit identified at time of analysis. Organizations operating devices with this wireless hardware face exposure of sensitive kernel information and potential service disruption. A vendor patch is available and should be prioritized for deployment.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 87% exploitable

Prevalence

Medium

RTL8723BS chip common in budget ARM tablets and SBCs

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back