CVE-2026-74651 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE.
The function locates a vendor-specific IE (EID 221) with rtw_get_ie() and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte version word at pbuf + 6. Those accesses require the IE body to be at least 6 bytes, but rtw_get_ie() only guarantees that the element fits within the buffer; it does not enforce a minimum body length. A vendor-specific IE whose length byte is 0 to 5, placed at the end of the buffer, therefore makes these reads run past the end of the IE and past the end of the buffer itself.
The buffer holds information elements taken from received management frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which is kmemdup'd to its exact length, so the read can run off the end of the allocation.
The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and rtw_get_wps_ie() in this file already reject too-short vendor-specific IEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in line with them, and needs a minimum of 6 rather than 4 bytes because of the version word. Add the missing length check.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel staging driver for the Realtek rtl8723bs wireless chipset contains a critical out-of-bounds read vulnerability within the rtw_get_wpa_ie function, which is responsible for parsing Wi-Fi Protected Access information elements from received management frames and configuration blobs. This flaw stems from an insufficient validation of buffer lengths before performing memory accesses that assume a minimum payload size. Specifically, the function attempts to locate a vendor-specific Information Element identified by Extended ID 221 using rtw_get_ie, which verifies only that the element fits within the provided buffer boundaries but does not enforce any constraints on the internal length field of that element. Once located, the code proceeds to read four bytes representing an Organizationally Unique Identifier and type at offset two from the start of the IE body, followed by a subsequent read of a two-byte version word at offset six. These operations collectively require the vendor-specific IE body to contain at least six bytes of data to remain within safe memory boundaries.
When a malformed or truncated Information Element with a length byte indicating fewer than six bytes is encountered, particularly if it appears near the end of the buffer, these fixed-offset reads extend beyond the allocated memory region. Because the underlying buffers are derived from received wireless management frames or duplicated configuration blobs via kmemdup, an attacker capable of injecting crafted 802.11 frames can trigger this out-of-bounds read. This vulnerability aligns with CWE-125, which describes Out-of-Bounds Read conditions where software reads data past the end or before the beginning of a buffer. The lack of bounds checking allows for potential information disclosure, as sensitive kernel memory adjacent to the allocation may be leaked into user space or processed incorrectly by subsequent logic that relies on these values being valid.
From an operational perspective, this vulnerability impacts the stability and security of wireless connectivity provided by devices utilizing the rtl8723bs chipset. An attacker in proximity could exploit this flaw through specially crafted beacon or probe response frames to cause a kernel panic due to invalid memory access, resulting in a denial of service against the network interface. Alternatively, if the read data is utilized in subsequent cryptographic checks or configuration decisions without further validation, it may lead to unexpected behavior that undermines the integrity of the wireless connection setup process. The ATT&CK framework categorizes such exploitation techniques under T1082, System Information Discovery, as reading arbitrary kernel memory can reveal internal state information useful for further attacks against the host system.
The root cause is identified as a logic error where rtw_get_wpa_ie was not updated to match the defensive coding practices of sibling helper functions within the same driver module, such as rtw_get_sec_ie, rtw_get_wapi_ie, and rtw_get_wps_ie. These other functions correctly reject vendor-specific Information Elements that are too short before attempting any memory comparisons or reads involving their contents. The fix involves adding a mandatory length check to ensure the IE body is at least six bytes long prior to accessing offsets two and six. This mitigation ensures that only well-formed elements with sufficient data are processed, thereby preventing out-of-bounds access. System administrators should apply kernel updates provided by their distribution vendors or upstream Linux maintainers to patch this vulnerability, ensuring that all wireless drivers enforce strict length validation on incoming protocol fields before parsing them for security-critical parameters like WPA versioning and OUI identification.