Skip to main content

rtl8723bs EUVDEUVD-2026-39269

| CVE-2026-53178 HIGH
Integer Underflow (CWE-191)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-c9gv-4j5c-v56g
Information Disclosure Linux Integer Overflow
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker within Wi-Fi range
  2. Delivery
    Send crafted 802.11 management frame
  3. Exploit
    Undersized IE triggers ie_length underflow
  4. Execution
    Out-of-bounds read in rtw_mlme
  5. Impact
    Kernel memory disclosure or crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-191
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
Exploitation Conditions

Exploitation requires the target to be running the Linux kernel rtl8723bs staging driver (i.e., a device with a Realtek RTL8723BS SDIO Wi-Fi chip and the driver loaded and active), and the attacker must be within wireless radio range (CVSS AV:A) to deliver a crafted 802.11 management frame with an undersized Information Element. No authentication (PR:N) and no user interaction (UI:N) are needed. Limiting factors: the attacker must be physically/RF-proximate (not exploitable over the internet), the specific Realtek chipset and driver must be present and the wireless interface operational, and impact is bounded to the local kernel (S:U, no scope change). The bug triggers only when ie_length is smaller than the fixed offset being subtracted, so it depends on the driver reaching the unguarded IE-parsing path.
Impact

Signals are mixed. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, base 8.1) indicates a high-severity, low-complexity, unauthenticated bug - but AV:A (adjacent) means the attacker must be within Wi-Fi radio range, not on the open internet, which materially limits mass exploitation. EPSS is very low (0.16%, 6th percentile) and the issue is NOT in CISA KEV, with no public exploit identified, consistent with a kernel memory-safety hardening fix rather than an actively weaponized flaw. There is no SSVC decision data in the input. The 'Information Disclosure' tag aligns with C:H, though in practice an unsigned underflow of this kind is at least as likely to cause a crash (A:H/DoS) as a controlled kernel info leak. Net assessment: a legitimately high-severity local-radius memory-safety bug, but real-world priority is moderate and bounded by the adjacency requirement and the niche, hardware-specific driver - patch on affected devices but it is not an emergency for general fleets.
Exploit ScenarioDerived

An attacker within Wi-Fi range of a vulnerable device crafts an 802.11 management frame containing a malformed Information Element whose declared/effective length is smaller than the fixed IE offsets the driver subtracts. When rtw_mlme parses it, ie_length underflows to a huge unsigned value, and the driver reads far beyond the frame buffer - crashing the kernel (DoS) or potentially leaking adjacent kernel memory. No authentication or user interaction is required; no public proof-of-concept is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Memory-safety flaw in the Linux kernel's staging rtl8723bs Realtek SDIO Wi-Fi driver allows an adjacent (radio-range) attacker to trigger an unsigned-integer underflow in the rtw_mlme information-element parsing path, leading to out-of-bounds reads that can disclose kernel memory or crash the system. The bug occurs because ie_length was not validated before fixed IE offsets were subtracted from it. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, but a vendor (upstream kernel) fix is available.

RemediationAI

Apply the upstream kernel fix: update to a stable kernel containing commits 542d65a6dbd9733baab96313c9fe76a76e93f484 and 88e994c57a79f62d5338231d8d37ee8dd98baffe (the patch series identified as 7.0.13 and 7.1), available via https://git.kernel.org/stable/c/542d65a6dbd9733baab96313c9fe76a76e93f484 and https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe; on distribution kernels, install the vendor's updated stable kernel package. Where immediate patching is not possible, the most effective compensating control is to unload/blacklist the rtl8723bs module if the RTL8723BS Wi-Fi chip is not needed (trade-off: disables Wi-Fi on devices that rely on this chipset), or disable the wireless interface and prefer wired/alternate connectivity. Because the attack vector is adjacent (Wi-Fi), operating affected devices only on trusted, controlled RF environments and away from untrusted access points/clients reduces exposure, though this does not eliminate the flaw.

Affected VersionsENISA

Linux 5.15
Linux d3fcee1b78a533c256077f1300dd236801397cf7 <88e994c57a79f62d5338231d8d37ee8dd98baffe
Linux patch: 7.1
Linux patch: 7.0.13
Linux d3fcee1b78a533c256077f1300dd236801397cf7 <542d65a6dbd9733baab96313c9fe76a76e93f484
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the rtl8723bs driver, a staging-tree Linux kernel driver for Realtek RTL8723BS SDIO 802.11n Wi-Fi chips commonly found in low-cost tablets, single-board computers, and embedded devices. The defect lives in rtw_mlme, the MLME (MAC sublayer management entity) code that parses 802.11 management-frame Information Elements (IEs). When the code subtracts fixed IE header offsets from ie_length without first confirming ie_length is at least that large, the unsigned subtraction wraps around to a very large value, causing subsequent length-driven reads/loops to access memory beyond the frame buffer. No CWE was assigned in the input, but the root cause class is an integer underflow (CWE-191) leading to an out-of-bounds read (CWE-125).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 8.1 HIGH

Adjacent radio delivery (AV:A) of a crafted management frame, no auth or interaction (PR:N/UI:N), unsigned underflow yields OOB read enabling kernel memory leak (C:H) and crash (A:H), no integrity impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.1 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction

Add guards to ensure ie_length is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow.

Executive ViewAI

Why It Matters

Organizations deploying Realtek SDIO Wi-Fi drivers within Linux kernel environments face a memory-disclosure and service-disruption vulnerability (CVE-2026-53178, CVSS 8.1) exploitable by proximate attackers. While the practical exploitation risk is minimal (EPSS 0.2%) due to required radio-range access, affected systems should apply the available vendor patch to eliminate potential kernel memory exposure and service interruption. This vulnerability primarily affects systems using specific Realtek wireless chipsets in kernel development or specialized deployments.

Business Impact: Medium
Compensating Controls

Apply vendor patch. Interim measures while patching: disable the rtl8723bs driver if not actively required, minimize exposure to untrusted wireless networks, or substitute alternative Wi-Fi chipsets if operationally feasible.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Low
niche Realtek SDIO Wi-Fi chipset driver, mainly low-cost embedded/SBC devices
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
Medium

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53178 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373747 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3156/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/18143799ad51a32b1351e4e1591b6285a0a9d7dd REF https://git.kernel.org/stable/c/542d65a6dbd9733baab96313c9fe76a76e93f484 REF https://git.kernel.org/stable/c/637e0ea73f690028796ee2fc72a2ac4ec32968c6 REF https://git.kernel.org/stable/c/8863ac3a4fedf86b0ef5b8ecc37fbaa52f2a8160 REF https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy