Look up another CVE · open CVE-2026-90017 in the interactive tracker
CVE-2026-90017
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90017 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 bytes (sizeof(struct ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and frame_body[1] requires frame_len >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before frame_body is dereferenced.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/rtl8723bs/core/rtw_ieee80211.c
- What this is
- STAGING SUBSYSTEMMAINTAINERS section matched on drivers/staging/ · linux-staging@lists.linux.dev · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.36%, higher than 28.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.12 | 5.10.270 | 15081ff835b2 |
| 4.12 | 5.15.221 | 310aaa8058d1 |
| 4.12 | 6.1.188 | 1410bce22351 |
| 4.12 | 6.6.157 | 0b7f64c7bb96 |
| 4.12 | 6.12.110 | 136f9a3ab87d |
| 4.12 | 6.18.51 | b041e3f35e0d |
| 4.12 | 7.2.5 | a54fd1a44862 |
| 4.12 | 7.3 | ff917923f4fb |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- rtw_action_frame_parse() is reached from rtw_cfg80211_rx_action() on received 802.11 public action frames (OnAction → on_action_public → on_action_public_default). A nearby attacker can inject a truncated management action frame over Wi-Fi; kernel CNA guidance maps Wi-Fi frame injection to Adjacent.
- AC:LAttack complexity, low
- An adjacent attacker fully controls the action-frame length and 802.11 header. A 24- or 25-byte management action frame (header only, or header plus category) reliably hits the missing length check with no race or attacker-uncontrollable layout.
- PR:NPrivileges required, none
- Public action frames are dispatched by mgt_dispatcher()/OnAction() with only a local-MAC match and no association or 802.11 authentication against the sender, so no local account or capability is required.
- UI:NUser interaction, none
- The rtl8723bs driver processes received management action frames automatically while the interface is up; no extra victim click, mount, or connect action is required at exploit time.
- S:UScope, unchanged
- The out-of-bounds read occurs in the host rtl8723bs driver and does not cross a VM, IOMMU, or other security-authority boundary.
- C:LConfidentiality impact, low
- The flaw reads only one or two bytes past a truncated 24- or 25-byte action frame. Per kernel CNA guidance this is a strictly bounded out-of-bounds read, not an arbitrary read primitive.
- I:NIntegrity impact, none
- The bug is a read-only out-of-bounds access of the category/action bytes; those values are not used to write kernel memory or hijack control flow.
- A:HAvailability impact, high
- A 1-2 byte kernel out-of-bounds read can oops or panic on KASAN, redzone, or hardened kernels, and an adjacent peer can repeat truncated action frames to deny availability.