Linux Kernel rtl8723bs CVE-2026-74649

The target device must have the rtl8723bs staging driver loaded and active, which requires Realtek RTL8723BS WiFi hardware. The device must be configured to perform WEP shared-key authentication - specifically, the wireless interface must be configured with a WEP shared-key network profile, as opposed to WPA2/WPA3 or WEP open-system authentication (which does not use challenge-text). The attacker must be within WiFi radio range of the target to transmit the malformed authentication frame. Exploitation occurs before association, so no prior network relationship or credentials are required from the attacker's side. Limiting factors include: WEP shared-key auth is a non-default, legacy configuration absent from most modern deployments; the driver is a staging driver not present in all kernel builds; and the attacker must achieve physical radio proximity (AV:A), precluding remote internet-based exploitation.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.8 and reflects a realistic threat model: the attack requires only WiFi radio adjacency, no credentials, and no user interaction beyond the device's normal connection attempt to a WEP AP. However, this score should be tempered by deployment context. WEP shared-key authentication is a deprecated legacy mode; most modern deployments use WPA2/WPA3, meaning the vast majority of rtl8723bs-equipped devices are not configured in the vulnerable mode. The EPSS score of 0.26% at the 18th percentile corroborates low exploitation probability - no KEV listing and no public POC further support that opportunistic mass exploitation is not occurring. Real-world risk is therefore concentrated in IoT, embedded, or legacy environments where WEP is still actively used with rtl8723bs hardware. The adjacent-network constraint (AV:A) means internet-facing exposure does not apply; an attacker must achieve physical or radio proximity. The staging driver classification also reduces overall fleet exposure compared to a mainline kernel subsystem. Taken together, this is a genuine high-severity issue for in-scope deployments but not a broadly critical internet-scale risk.

An attacker within WiFi radio range of a device using the rtl8723bs driver sets up a rogue access point advertising WEP shared-key authentication on the same SSID the target device expects. When the target initiates the WEP shared-key handshake, the attacker's rogue AP responds with a crafted WLAN_EID_CHALLENGE element whose length field is set to 255 rather than the standard 128 bytes. The target's OnAuthClient() passes this attacker-controlled length to memcpy(), overflowing the 128-byte chg_txt buffer by 127 bytes into adjacent kernel memory, potentially enabling code execution or kernel crash. No public POC has been identified at time of analysis.