Linux Kernel CVE-2026-98160

Exploitation requires: (1) a kernel built with the CONFIG_RTL8723BS staging driver, (2) presence of the error path in rtw_sdio_if1_init() being reached during SDIO interface initialization, and (3) local access sufficient to load or re-probe the driver. The faulty free executes ONLY in the init failure path - on normal successful initialization the bug is never reached, which is a significant limiting factor. The attack is purely local (AV:L); there is no network vector and no user interaction. Realistically it is most likely to manifest as an accidental kernel memory-corruption/crash rather than a reliably weaponizable attacker-triggered primitive, and only on systems with RTL8723BS SDIO Wi-Fi hardware.

This is a low-priority, low-real-risk issue despite its MEDIUM 5.5 CVSS rating. All signals converge on low urgency: the CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - purely local, with impact limited to availability (A:H) and no confidentiality or integrity loss. EPSS is 0.17% (5th percentile), among the lowest exploitation probabilities. The CVE is NOT on CISA KEV, and no public exploit or POC is referenced in the provided data. There is no SSVC decision data supplied. The flaw (CWE-763, release of an invalid pointer - kfree() on a vzalloc()-backed buffer) only triggers on the error path of rtw_sdio_if1_init() in the rtl8723bs SDIO Wi-Fi staging driver, so it is not a straightforwardly attacker-controllable condition. One signal conflict to note: the input Tags label this 'Buffer Overflow,' which contradicts the actual weakness (mismatched free / memory corruption, CWE-763) - verify tagging. The patch set's own commit message states no runtime testing was possible and no suitable hardware was available, reinforcing that this is a static-analysis-driven hardening fix rather than an observed exploited condition.

A local, low-privileged user or process able to trigger (re)initialization of the rtl8723bs SDIO Wi-Fi driver forces the rtw_sdio_if1_init() routine down its failure path, where padapter->HalData - allocated with vzalloc() - is incorrectly released with kfree(). The resulting vmalloc/kfree mismatch corrupts kernel memory management structures, most plausibly causing a kernel crash (denial of service) consistent with the A:H-only impact. No public exploit or POC is referenced, and the local attack vector with low complexity still depends on reaching a rarely-hit init error path.