CVE-2026-100076 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from the driver's fixed-size management-TX pools via alloc_mgtxmitframe(). On the normal path the frame is handed to dump_mgntframe(), which transfers ownership and eventually returns both objects to their pools (the frame and, for beacons, the buf in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion path).
Several error/edge paths return early after a successful alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never transferred and neither object is freed:
- issue_beacon(): beacon larger than 512 bytes - issue_probersp(): cur_network->ie_length > MAX_IE_SZ - issue_probersp(): kzalloc() of the SSID scratch buffer fails - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP
Because alloc_mgtxmitframe() removes the frame and buf from their free lists (list_del_init) without placing them on any pending list, an orphaned pair is on no list and referenced by nobody, so it is only reclaimed at driver teardown. Repeated hits progressively exhaust the management-TX pools until alloc_mgtxmitframe() returns NULL and the interface can no longer send beacons or probe/assoc responses.
Free the frame and buffer on these paths, matching the existing correct error handling in issue_assocreq().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified within the Linux kernel staging driver for the Realtek rtl8723bs wireless chipset represents a critical resource management flaw characterized by memory leaks of transmission frames and associated buffers. This defect occurs specifically during the initialization and transmission of management frames, which are essential for basic Wi-Fi network operations such as beaconing, probe responses, and association requests. The core issue stems from improper handling of error conditions within three primary functions: issue_beacon, issue_probersp, and issue_asocrsp. These functions rely on a fixed-size pool of pre-allocated management transmission buffers to ensure low-latency frame processing in real-time wireless environments. When these functions successfully allocate a management transmit frame via alloc_mgtxmitframe, they remove the corresponding frame structure and its associated buffer from the driver's free lists. Under normal operational circumstances, ownership is transferred through dump_mgntframe, which eventually returns both objects to their respective pools for reuse. However, several error paths exist where the function exits early due to validation failures or allocation errors before this transfer of ownership can occur.
The specific conditions triggering these leaks include beacon payloads exceeding a hardcoded limit of five hundred twelve bytes, information element lengths surpassing maximum allowed sizes in probe responses, failure to allocate scratch buffers for SSID data via kzalloc, and invalid packet types during association response generation. In each of these scenarios, the alloc_mgtxmitframe function has already executed its list manipulation logic, effectively removing the frame and buffer from the global free pool without placing them on any pending or active transmission queue. Consequently, these resources become orphaned; they are no longer referenced by any data structure within the driver's memory management subsystem and cannot be reclaimed until the entire driver module is unloaded or the system shuts down. This behavior transforms what might appear as minor code defects into a significant denial-of-service vector against network availability for devices relying on this specific hardware interface.
The operational impact of this vulnerability is progressive resource exhaustion leading to complete functional failure of the wireless interface. As an attacker or environmental conditions trigger these error paths repeatedly, such as by sending malformed beacon frames or triggering association failures with oversized information elements, the fixed-size management-TX pools are gradually depleted. Once all available buffers in these pools are leaked and unrecoverable during runtime, subsequent calls to alloc_mgtxmitframe will return NULL pointers. This state renders the wireless adapter incapable of transmitting any further management traffic. Since beacons, probe responses, and association frames constitute the fundamental control plane for Wi-Fi connectivity, their inability to transmit effectively disconnects the device from existing networks and prevents it from joining new ones or advertising its presence on local subnets. This constitutes a severe availability impact, aligning with CWE-401 regarding missing release of memory after effective lifetime and CWE-789 concerning improper control of resource consumption through unbounded allocation in constrained environments.
From a threat modeling perspective utilizing the MITRE ATT&CK framework, this vulnerability facilitates local denial-of-service attacks that can be executed by any user or process with access to network interfaces capable of injecting raw frames or triggering driver-specific error conditions. It does not inherently provide privilege escalation or remote code execution capabilities but serves as an effective mechanism for disrupting wireless connectivity on affected systems. The root cause is classified under CWE-20, Improper Input Validation, specifically the failure to handle edge cases and invalid inputs gracefully within the network stack's device drivers. Furthermore, it reflects CWE-404, which addresses insufficient system shutdown or cleanup procedures when errors occur during critical resource acquisition phases.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided kernel patches that correct the error handling logic in the affected functions. The fix requires ensuring that any code path exiting after a successful allocation of management frames explicitly frees both the xmit_frame structure and its associated xmit_buf before returning control to the caller. This aligns with established best practices for driver development where resource acquisition must be strictly paired with corresponding release mechanisms, often implemented using goto-based cleanup labels or explicit free calls in every error branch. System administrators should ensure that their Linux distributions are updated with patched versions of the rtl8723bs driver module to prevent progressive pool exhaustion. Additionally, network monitoring tools can detect anomalies indicative of this exploitation attempt by observing sudden drops in management frame transmission rates following bursts of malformed traffic targeting beacon or association endpoints on affected hardware.