CVE-2026-74648 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: validate monitor transmit frame lengths
rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains.
The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes.
Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in the Linux kernel staging driver rtl8723bs represents a critical input validation failure within the wireless network interface handling logic, specifically affecting monitor mode transmission operations. The core issue resides in the rtw_cfg80211_monitor_if_xmit_entry function, which is responsible for processing frames captured or transmitted in monitor mode. In this context, the driver attempts to parse radiotap headers and subsequent 802.11 frame structures without adequately verifying that sufficient data remains in the socket buffer after initial header removal operations. This lack of boundary checking allows an attacker who can inject crafted network traffic into a monitored interface to trigger out-of-bounds memory reads or writes, potentially leading to information disclosure or arbitrary code execution depending on the kernel state and architecture specifics.
From a technical perspective, the flaw stems from a sequence of unsafe pointer arithmetic and buffer access operations. The function first removes the radiotap header, which is an optional encapsulation layer used in wireless packet captures, but fails to verify that the remaining data length still accommodates the base 802.11 header structure. Subsequently, the code calculates the expected span of additional headers such as QoS and SNAP fields based on assumptions about frame type rather than actual available buffer size. When a truncated or malformed frame is processed, these calculations may result in accessing memory locations beyond the allocated skb data region. This behavior directly maps to CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write vulnerabilities, as the driver proceeds to read from or write to Ethernet address fields without confirming that the necessary bytes are present in the packet buffer.
The operational impact of this vulnerability is significant for systems utilizing rtl8723bs wireless adapters in monitor mode, a configuration often employed by security professionals and network administrators for traffic analysis and intrusion detection. An attacker with local access or the ability to inject packets into the monitored interface can exploit this flaw to crash the kernel via a denial-of-service condition caused by an invalid memory access fault. More severely, if the out-of-bounds write targets specific control structures or function pointers within the kernel heap, it could allow for privilege escalation from user space to ring zero. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter in contexts where script-like injection leads to execution, though more accurately classified under T1203 Exploitation for Client Execution if leveraging local vector, or generally as an exploitation of software vulnerabilities during network communication processing.
Mitigation strategies primarily involve the application of upstream kernel patches that enforce strict length checks before any header parsing occurs. The fix requires validating that after removing the radiotap header, at least the minimum size of a base 802.11 frame remains in the socket buffer. Furthermore, the driver must verify that the total packet length encompasses all expected headers including QoS and SNAP fields based on the frame control field values before attempting to extract or modify Ethernet addresses. Administrators should ensure their systems are updated with the latest stable kernel versions containing this fix. In environments where immediate patching is not feasible, restricting monitor mode usage to trusted interfaces and implementing strict ingress filtering at the network perimeter can reduce the attack surface by preventing untrusted or malformed frames from reaching the vulnerable driver code path.