CVE-2026-74649 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix missing shared-key auth challenge length check
The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer.
In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory.
The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
This vulnerability represents a critical input validation failure within the Linux kernel's staging driver for Realtek rtl8723bs wireless network adapters, specifically affecting the WEP shared-key authentication process. The core technical flaw lies in the OnAuthClient function where the handler retrieves the length of the challenge-text element from an incoming WLAN_EID_CHALLENGE frame using rtw_get_ie(). This retrieved length value is directly attacker-controlled and can range up to 255 bytes, yet it is used without any bounds checking against the fixed size of the destination buffer pmlmeinfo->chg_txt, which is defined as exactly 128 octets. The vulnerability stems from a fundamental lack of validation before performing memory operations on this buffer, allowing for both heap overflow and information disclosure scenarios depending on whether the provided length exceeds or falls short of the actual data available in the frame relative to the buffer size expectations.
The operational impact is severe due to the network-level reachability of the flaw. An attacker positioned within wireless range can craft a malicious access point that broadcasts malformed authentication frames containing an incorrectly sized challenge element. If the attacker sends a length value greater than 128, the subsequent memcpy operation will write data beyond the allocated bounds of the chg_txt buffer, resulting in a heap-based buffer overflow. This type of memory corruption can lead to arbitrary code execution if the adjacent memory structures are controlled or predictable, potentially allowing full compromise of the host system running the vulnerable driver. Conversely, if the attacker sends a length value that results in an underfill relative to expected processing logic elsewhere, the driver may echo stale buffer memory containing sensitive information from previous operations, leading to unauthorized data disclosure.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and CWE-20 Improper Input Validation. The attack vector is classified under MITRE ATT&CK technique T1595 Active Scanning as the initial phase involves probing for vulnerable devices, followed by potential exploitation techniques related to remote code execution or information leakage depending on the specific outcome of the malformed packet processing. The vulnerability exists in a pre-association context, meaning it can be exploited before any authenticated session is established, making it particularly dangerous against users who connect automatically or manually to untrusted networks during setup phases.
The resolution implemented by the kernel maintainers addresses this flaw by enforcing strict length validation prior to memory operations. Specifically, the code now requires that the challenge element's length must exactly match the WLAN_AUTH_CHALLENGE_LEN constant, which is defined as 128 bytes. By rejecting any authentication frame where the challenge text does not conform to this exact specification, the driver prevents both out-of-bounds writes and inconsistent buffer states. This fix exemplifies the principle of least privilege in input handling by ensuring that only well-formed protocol data structures are processed by sensitive cryptographic or memory management routines. System administrators should ensure their systems are updated with patches containing this staging driver correction to mitigate risks associated with rogue access points attempting to exploit wireless authentication mechanisms on devices utilizing rtl8723bs hardware.