Skip to main content

Linux Kernel EUVDEUVD-2026-39270

| CVE-2026-53179 HIGH
Out-of-bounds Read (CWE-125)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-jr2w-mc6v-cfpj
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local low-priv trigger of an over-read (AV:L/AC:L/PR:L) disclosing adjacent kernel memory (C:H) and risking a driver crash (A:H); no data modification (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 18:27 vuln.today
CVSS changed
Jul 06, 2026 - 18:22 NVD
7.1 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
HIGH 7.1
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix buffer over-read in rtw_update_protection

rtw_update_protection() is called with a pointer offset into the ies buffer but the full ie_length is passed, causing a potential buffer over-read.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's rtl8723bs staging Wi-Fi driver (Realtek RTL8723BS SDIO) lets a local low-privileged actor read past the intended information-element (IE) buffer. rtw_update_protection() receives a pointer already offset into the ies buffer while still being passed the full ie_length, so parsing walks beyond the valid data. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%, 7th percentile), it is not in CISA KEV, and fixed kernel releases are available.

Technical ContextAI

The affected component is drivers/staging/rtl8723bs, the in-kernel driver for the Realtek RTL8723BS 802.11n SDIO Wi-Fi chipset, still in the kernel's staging tree (a lower code-quality bar than mainline). The bug is a classic CWE-125 out-of-bounds read: rtw_update_protection() parses 802.11 information elements (IEs), but the caller advances the buffer pointer by an offset while continuing to pass the original, un-adjusted ie_length. The length therefore over-describes the remaining bytes and the parser reads beyond the end of the buffer. CPE data scopes this to cpe:2.3:o:linux:linux_kernel, with the regression window tied to commit d3fcee1b78a5 and fixes landing across the 6.18.x, 7.0.x, and 7.1 branches.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.18.36, 7.0.13, or 7.1 (or later on your branch), which correct the pointer/length mismatch in rtw_update_protection(); the upstream fixes are the commits at https://git.kernel.org/stable/c/735dabdf21561a24d8bcae456c9c32f7f961a029 and its stable backports (303f65af819f6d5aa302e82bce72b57a8575faea, 514ab98364595007d4557ecc85d7e5f012c504d3, c35ce55b12bb8fcd365daeb516e9782048119b36). If you cannot patch immediately and do not use Realtek RTL8723BS SDIO Wi-Fi hardware, blacklist and unload the module (blacklist r8723bs / rtl8723bs) to remove the vulnerable code path entirely - the trade-off is loss of Wi-Fi on devices that depend on this chipset. On systems that require the chipset, restrict local access and avoid connecting to untrusted wireless networks until patched, since the parser handles externally-supplied IE data.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39270 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy