Look up another CVE · open CVE-2026-74651 in the interactive tracker
CVE-2026-74651
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74651 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE. The function locates a vendor-specific IE (EID 221) with rtw_get_ie() and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte version word at pbuf + 6. Those accesses require the IE body to be at least 6 bytes, but rtw_get_ie() only guarantees that the element fits within the buffer; it does not enforce a minimum body length. A vendor-specific IE whose length byte is 0 to 5, placed at the end of the buffer, therefore makes these reads run past the end of the IE and past the end of the buffer itself. The buffer holds information elements taken from received management frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which is kmemdup'd to its exact length, so the read can run off the end of the allocation. The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and rtw_get_wps_ie() in this file already reject too-short vendor-specific IEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in line with them, and needs a minimum of 6 rather than 4 bytes because of the version word. Add the missing length check.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/rtl8723bs/core/rtw_ieee80211.c
- What this is
- STAGING SUBSYSTEMMAINTAINERS section matched on drivers/staging/ · linux-staging@lists.linux.dev · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.27%, higher than 18.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.12 | 5.10.265 | 4fc459c5cd87 |
| 4.12 | 5.15.216 | b45be82387bf |
| 4.12 | 6.1.183 | c9068f82a090 |
| 4.12 | 6.6.152 | 0d19f0600fbb |
| 4.12 | 6.12.104 | 42c5a0d454aa |
| 4.12 | 6.18.45 | e167a38a8a8f |
| 4.12 | 7.1.9 | 01ab275f8f3e |
| 4.12 | 7.2 | 1c3e23e78862 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- rtw_get_wpa_ie() is reached when rtl8723bs parses attacker-controlled 802.11 management IEs from received beacons during client auth/association (OnBeacon→rtw_get_bcn_info/rtw_check_bcn_info); per kernel guidance WiFi frame delivery requires an adjacent wireless attacker.
- AC:LAttack complexity, low
- An adjacent attacker fully controls beacon/probe-response IE layout; placing a trailing vendor-specific IE (EID 221) with length 0–5 and a matching WPA OUI reliably triggers the missing minimum-length check without races or uncontrollable victim state.
- PR:NPrivileges required, none
- Exploitation via malicious or spoofed over-the-air beacons requires no account, capabilities, or WPA credentials on the victim; the vulnerable parsing runs on pre-authentication and periodic beacon paths before any verified association secrets.
- UI:NUser interaction, none
- An evil-twin or rogue AP can deliver malformed beacons matching a victim's connected BSSID during automatic beacon processing without requiring new user clicks, mounts, or connect actions beyond routine WiFi operation.
- S:UScope, unchanged
- Impact is confined to kernel memory reads/crashes inside the rtl8723bs WiFi driver on the same host; there is no demonstrated VM escape, container breakout, or IOMMU boundary crossing.
- C:HConfidentiality impact, high
- The bug performs unchecked memcmp()/memcpy() up to six bytes past the end of a kmemdup'd IE buffer or declared IE length, reading adjacent kernel/heap memory; under the conservative OOB-read rule this is high confidentiality impact.
- I:NIntegrity impact, none
- The flaw is a read-only out-of-bounds access with no memory write, structure corruption, or demonstrated control-flow hijack primitive; it cannot modify kernel data or achieve code execution on its own.
- A:HAvailability impact, high
- Reading past a kmemdup allocation or declared IE boundary can fault on unmapped pages or provoke a kernel oops during beacon/auth processing; an adjacent attacker can repeat crafted management frames to deny availability.