CVE-2026-68190 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically:
- in_ie[cnt + 1] is read without checking cnt + 1 < in_len
- memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
- in_ie[cnt + 1] is used as length without verifying payload fits
Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer. Also require at least 4 bytes of payload before comparing the WPS OUI.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in question affects the rtl8723bs staging driver within the Linux kernel, specifically within the rtw_get_wps_ie() function that processes wireless network management information elements. This represents a classic out-of-bounds read condition that occurs when parsing structured data from incoming network frames without proper buffer validation. The flaw resides in how the function handles information element (IE) data processing where it assumes all IE headers and payloads are properly formatted and contained within the expected buffer boundaries. According to CWE-129, this vulnerability falls under improper validation of array indices, while the ATT&CK framework would categorize this as a technique involving memory corruption through invalid pointer references during network packet processing.
The technical implementation of this vulnerability demonstrates a fundamental flaw in input validation where the function iterates through IE data without verifying that each access operation remains within the confines of the provided buffer. The specific issue occurs when accessing in_ie[cnt + 1] to determine element length without first ensuring that cnt + 1 is less than the total buffer length in_len, followed by subsequent memory comparisons that reference cnt + 2 without bounds checking. This creates a scenario where an attacker could craft malicious network frames containing malformed IE data that would cause the kernel to read beyond allocated memory boundaries, potentially leading to information disclosure or system instability.
The operational impact of this vulnerability extends beyond simple buffer overflows as it represents a potential pathway for privilege escalation and denial of service attacks within wireless networking contexts. When exploited, the out-of-bounds reads could allow attackers to extract sensitive kernel memory contents, corrupt data structures, or potentially enable code execution in kernel space through carefully crafted network packets. The vulnerability affects systems utilizing the rtl8723bs driver, which is commonly found in various wireless adapters and embedded devices where wireless management frames are processed, making it particularly concerning for enterprise and consumer devices that rely on this specific hardware driver implementation.
Mitigation strategies should focus on implementing comprehensive bounds checking at the beginning of each iteration cycle within the parsing loop to validate remaining buffer space before any memory access operations. The recommended solution involves adding early termination conditions that check if fewer than two bytes remain for IE header processing or if declared payload lengths would exceed available buffer boundaries. Additionally, requiring a minimum four-byte payload before performing WPS OUI comparisons provides an extra layer of protection against malformed packet exploitation attempts. These defensive programming practices align with secure coding guidelines and help prevent similar vulnerabilities across other kernel subsystems that process network frame data, as outlined in various cybersecurity frameworks including the CERT Secure Coding Standards and NIST guidelines for kernel security hardening.