Look up another CVE · open CVE-2026-74648 in the interactive tracker
CVE-2026-74648
staging: rtl8723bs: validate monitor transmit frame lengths
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74648 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes. Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
- What this is
- STAGING SUBSYSTEMMAINTAINERS section matched on drivers/staging/ · linux-staging@lists.linux.dev · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.12 | 5.10.265 | f03398d835f5 |
| 4.12 | 5.15.216 | a3ac6d849de5 |
| 4.12 | 6.1.183 | 7edd3adb0c80 |
| 4.12 | 6.6.152 | c5e5d7874399 |
| 4.12 | 6.12.104 | 7b0f62d2986a |
| 4.12 | 6.18.45 | 8b3e4ed9c35d |
| 4.12 | 7.1.9 | bd88f6289b7e |
| 4.12 | 7.2 | 6829665d0509 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is only reachable via local userspace transmitting crafted radiotap skbs to the rtl8723bs monitor netdev ndo_start_xmit handler (cfg80211 NEW_INTERFACE + packet socket/dev_queue_xmit); remote WiFi peers cannot drive this transmit-only parsing path.
- AC:LAttack complexity, low
- An attacker fully controls monitor TX skb length and 802.11 header fields after the fixed 14-byte radiotap prefix; sending a truncated frame (e.g., radiotap-only or short DATA header) reliably triggers the missing bounds checks without races or layout dependencies.
- PR:LPrivileges required, low
- Exploitation requires creating a monitor virtual interface via nl80211 (GENL_UNS_ADMIN_PERM/CAP_NET_ADMIN) and injecting frames via CAP_NET_RAW packet sockets; per kernel CNA guidance these capabilities are PR:L when obtainable through user namespaces on embedded rtl8723bs systems.
- UI:NUser interaction, none
- No victim interaction is required once the attacker can create or access the monitor interface; exploitation is a direct syscall/netlink and packet-socket operation without needing the user to connect, mount, or approve an action.
- S:UScope, unchanged
- Impact is confined to kernel memory corruption and privilege escalation within the host kernel running the rtl8723bs SDIO WiFi driver; it does not cross VM, container, or IOMMU security boundaries.
- C:HConfidentiality impact, high
- Reading dot11_hdr->frame_control and memcpy of addr1/addr2 without verifying at least 24 bytes remain after radiotap removal causes out-of-bounds kernel reads of adjacent skb and kmalloc memory, enabling information disclosure.
- I:HIntegrity impact, high
- On the DATA path, skb_pull and subsequent memcpy of 12-byte Ethernet addresses into skb->data without ensuring sufficient tail room can write past the skb buffer end, providing exploitable heap corruption for arbitrary kernel writes.
- A:HAvailability impact, high
- Out-of-bounds reads and writes in kernel softirq transmit context on SDIO WiFi embedded devices (CHIP, Intel Compute Stick, ARM SBCs) can trigger kernel oops, panic, or hang, causing complete loss of availability.