EUVD-2026-80625
GHSA-9fp4-x69f-gf9f
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Reachable only via local cfg80211 mgmt_tx/monitor xmit needing interface access (AV:L/PR:L); a 1-2 byte OOB read discloses nothing usable (C:N) and only marginally risks a crash (A:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body:
const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1];
frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read.
This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through.
Add the missing length check before frame_body is dereferenced.
AnalysisAI
A 1-2 byte out-of-bounds read in the Linux kernel's rtl8723bs staging Wi-Fi driver (rtw_action_frame_parse) lets a local attacker who can inject 802.11 management action frames cause a kernel fault, with practical impact typically limited to a crash when the read crosses a page boundary. The vendor assigned CVSS 7.1 (AV:A/AC:L/PR:N), but our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L because exploitation requires the rtl8723bs driver to be loaded and bound to Realtek RTL8723BS hardware plus local interface access (typically CAP_NET_ADMIN) to reach the cfg80211 mgmt_tx path or a monitor-mode interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target system to use the rtl8723bs staging Wi-Fi driver, and requires the ability to transmit management/action frames through the interface - specifically via the cfg80211 mgmt_tx path (cfg80211_rtw_mgmt_tx) or a monitor-mode interface (rtw_cfg80211_monitor_if_xmit_entry). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-real-risk issue despite a 7.1 vendor CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to a kernel that contains the fix - stable 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110 or 6.18.51 (or later), or mainline 7.3-rc2 and above; distribution kernels should be updated to the vendor's rebuilt package for any of those stable branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems with Realtek RTL8723BS Wi-Fi hardware and the rtl8723bs kernel driver loaded using inventory tools or commands like 'lsmod | grep rtl8723bs'; if the driver is not required, immediately blacklist it to prevent loading. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today