Linux Kernel EUVD-2026-64588

Exploitation requires the target system to have an RTL8723BS WiFi chipset physically installed and the r8723bs kernel staging module actively loaded - systems without this hardware or with the module blacklisted are not exploitable. The attack is delivered over the 802.11 wireless medium, so the attacker must be within radio range of the target device; no prior authentication to the wireless network or the target system is required (CVSS PR:N, AV:A). The management frame processing path that triggers the vulnerable code can be reached while the device is scanning or in infrastructure mode - the chipset does not need to be associated to any network. Limiting factors beyond hardware presence are: physical radio proximity requirement (no remote internet exploitation), the staging module must not be blacklisted, and the kernel must be an unpatched version between 4.12 and the respective patched stable releases. No special user configuration or enabled feature flag is required beyond having the hardware present and the module loaded.

The CVSS 8.1 score (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) accurately reflects the vulnerability class: a no-authentication, low-complexity adjacent-network read that can yield kernel heap disclosure and system crash. However, real-world risk is substantially bounded by hardware specificity - exploitation requires the RTL8723BS chipset to be present and the r8723bs staging module to be loaded, which constrains the affected population to embedded systems, ARM single-board computers, and similar niche hardware, not typical enterprise servers or workstations. The adjacent attack vector (AV:A) further limits opportunistic mass exploitation to attackers within WiFi radio range of the target. EPSS at 0.22% (13th percentile) corroborates low observed interest, no public exploit code has been identified, and CISA KEV listing is absent. SSVC signals point to: exploitation status unproven, automation possible (crafted frame is trivially repeatable once in range), technical impact partial (read-only, no code execution primitive identified). The CVSS is not misleading here - the score is appropriate - but the restricted hardware footprint and proximity requirement mean this ranks well below a similarly-scored network-accessible vulnerability on actual organizational risk priority lists.

An attacker positioned within WiFi radio range of a device running the unpatched Linux kernel with the r8723bs staging module loaded crafts a malicious 802.11 management frame containing a vendor-specific information element (EID 221) with a body length field set to 0-5 bytes, placed at the tail of the IE buffer. When the RTL8723BS driver ingests this frame and rtw_get_wpa_ie() processes it, the function reads 6 bytes at the IE start without a length check, running off the end of the kmemdup'd allocation and potentially disclosing adjacent kernel heap contents or triggering a kernel panic. No public exploit code has been identified at time of analysis, but the out-of-bounds access is deterministic and the crafted frame requires no prior authentication or network association.