Look up another CVE · open CVE-2026-90018 in the interactive tracker
CVE-2026-90018
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90018 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
rtw_get_wps_attr() walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte attribute header (2-byte ID + 2-byte length) fits inside the IE: if (attr_ptr + 4 > wps_ie + wps_ielen) break; u16 attr_id = get_unaligned_be16(attr_ptr); u16 attr_data_len = get_unaligned_be16(attr_ptr + 2); u16 attr_len = attr_data_len + 4; attr_data_len (and therefore attr_len) is read directly from the wire and is never checked against the remaining bytes in the IE before being used as the size of: memcpy(buf_attr, attr_ptr, attr_len); Since attr_len is fully attacker controlled (0 to 65535+4), this is both a heap OOB read of wps_ie, and, more seriously, a stack buffer overflow at several call sites where buf_attr is a single-byte stack variable, e.g. rtw_get_wps_attr_content()'s callers passing WPS_ATTR_SELECTED_REGISTRAR into a stack "u8 sr"/"u8 selected_registrar" (drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c, drivers/staging/rtl8723bs/core/rtw_mlme_ext.c). A crafted WPS IE in a beacon or probe response processed during scanning can therefore smash the stack of the parsing thread. rtw_get_wps_attr_content() itself has no independent length check and simply trusts the attr_len it gets back from rtw_get_wps_attr(), so fixing the bound here also fixes that caller. The "attr_ptr + 4 > wps_ie + wps_ielen" header check above was added by commit 1463ca3ec6601 ("staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()"), which bounded the fixed header but never extended the check to cover the variable-length attribute data that follows it. Add that missing check before attr_len is used as a memcpy() length or accepted as a match.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/rtl8723bs/core/rtw_ieee80211.c
- What this is
- STAGING SUBSYSTEMMAINTAINERS section matched on drivers/staging/ · linux-staging@lists.linux.dev · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.45%, higher than 37.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.12 | 5.15.221 | 931640dfcb8c |
| 4.12 | 6.1.188 | 3a6457ebf390 |
| 4.12 | 6.6.157 | fd5e24ea8373 |
| 4.12 | 6.12.110 | a53d1ac9ce63 |
| 4.12 | 6.18.51 | ff61aa328935 |
| 4.12 | 7.2.5 | 34f51d196c43 |
| 4.12 | 7.3 | 99aa998dec83 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- A nearby attacker injects a crafted 802.11 beacon or probe response carrying a malformed WPS IE; rtl8723bs receives it over SDIO during scan (OnBeacon/OnProbeRsp → collect_bss_info → rtw_cfg80211_inform_bss → rtw_get_wps_attr), so the attacker must be on the same WiFi radio segment.
- AC:LAttack complexity, low
- The attacker fully controls the WPS attribute ID and the 16-bit length field and can reliably hit the parser on any scan; no race, rare config, or other condition outside the attacker’s control is required.
- PR:NPrivileges required, none
- Beacons and probe responses are processed before any association or authentication with the attacker-controlled BSS, so no local account, capability, or WiFi credentials on the victim are required.
- UI:NUser interaction, none
- Phones, Atom laptops, and IoT devices with this chip perform background and NetworkManager scans without a per-attack user action; once the interface is scanning, the driver parses received management frames on its own.
- S:UScope, unchanged
- The overflow corrupts kernel stack and adjacent heap inside the rtl8723bs driver; impact stays in the host kernel security authority and does not cross a VM, container, or IOMMU boundary.
- C:HConfidentiality impact, high
- attr_data_len is attacker-controlled (up to 65535) and is used as a memcpy length without bounding to the IE, so the copy reads far past the WPS IE into kernel heap and the resulting stack smash can be leveraged for further disclosure.
- I:HIntegrity impact, high
- rtw_get_wps_attr_content() memcpy’s the claimed payload into a 1-byte stack variable (u8 sr/selected_registrar) using the unchecked length, producing an attacker-sized stack overflow that can overwrite return addresses and enable kernel code execution.
- A:HAvailability impact, high
- A multi-kilobyte (or wrapped near-4GB) stack smash in the scan/BSS-inform path trips stack canaries or corrupts kernel control data and causes an oops, panic, or hang of the victim device.