Skip to main content

Linux Kernel EUVDEUVD-2026-27784

| CVE-2026-43225 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-r27m-4434-33fh
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local driver-level memory leak exploitable by any authenticated user; no confidentiality or integrity impact, availability impact via memory exhaustion only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:58 vuln.today
CVSS changed
May 08, 2026 - 21:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix memory leak on failure path

cfg80211_inform_bss_frame() may return NULL on failure. In that case, the allocated buffer 'buf' is not freed and the function returns early, leading to potential memory leak. Fix this by ensuring that 'buf' is freed on both success and failure paths.

AnalysisAI

Memory leak in the Linux kernel's staging rtl8723bs Wi-Fi driver degrades system availability for hosts running affected kernel versions with Realtek RTL8723BS hardware. The flaw occurs in the BSS scanning code path where cfg80211_inform_bss_frame() can return NULL on failure, but the previously allocated 'buf' buffer is not released, causing unbounded kernel memory loss over time. With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code, this is a low-urgency memory management defect patched across all active stable kernel branches.

Technical ContextAI

The rtl8723bs driver resides in the Linux kernel's 'staging' tree - drivers not yet meeting mainline quality standards - and provides support for Realtek RTL8723BS 802.11n Wi-Fi chipsets commonly found in embedded platforms and single-board computers. The affected code path lies in the BSS (Basic Service Set) scan result reporting function, which calls cfg80211_inform_bss_frame() to pass discovered access point frames to the cfg80211 wireless subsystem. Per the Linux wireless stack design, cfg80211_inform_bss_frame() can legitimately return NULL on internal allocation or parsing failure. The driver failed to handle this error path correctly: the buffer 'buf' allocated before the call was not freed when NULL was returned, and the function returned early - a textbook CWE-401 (Missing Release of Memory after Effective Lifetime) defect. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected kernel versions from initial commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 onward until the respective stable-branch fix commits.

RemediationAI

Upgrade to a patched kernel version corresponding to the deployed stable branch: 5.15.202 or later, 6.1.165 or later, 6.6.128 or later, 6.12.75 or later, 6.18.16 or later, 6.19.6 or later, or kernel 7.0. Upstream fix commits are available at https://git.kernel.org/stable/c/9874e33ce52ba449ab0ade78752a2d37a2294617 (6.1.x), https://git.kernel.org/stable/c/8311bb40698ba027649d5d1ca84ad4bf25270546 (5.15.x), https://git.kernel.org/stable/c/9f70f78e22b321429afc77befecedf05543d4e2c (mainline), and related commits for other branches. Ubuntu users should apply USN-8492-1. As a compensating control on systems that do not use the RTL8723BS chipset, the driver module can be blacklisted by adding 'blacklist r8723bs' to /etc/modprobe.d/ - this eliminates the code path entirely with no functionality impact where the hardware is absent. On systems actively using the chipset, reducing Wi-Fi scanning frequency or temporarily disabling scanning via iw/nmcli limits leak triggering but does not eliminate it; kernel patching remains the only durable fix.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27784 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy