CVE-2025-68254

What it actually does

Out-of-bounds read in OnBeacon ESR IE parsing that accesses bytes beyond the received frame buffer without length validation, potentially triggering kernel panic.

Why it matters to the business

Systems using affected Linux kernels with the rtl8723bs driver may experience unexpected crashes or instability when processing malformed wireless beacons; low exploit likelihood and no known active campaigns reduce immediate operational risk despite wide Linux ecosystem prevalence.

How an attack unfolds

An attacker crafts a wireless beacon frame containing an Extended Supported Rates IE positioned at the very end of the buffer and transmits it to a vulnerable device; the OnBeacon handler then performs unchecked accesses to offsets beyond the frame, causing the out-of-bounds read and possible panic.

How to fix it

Update to a kernel containing commit c03cb111628924827351e19baa5b073e9b0d723d or later; for packaged distributions apply the corresponding fixed version such as the 2.45-3 series where backported.

How to confirm the fix worked

Verify the applied kernel contains the boundary-check patch in staging/rtl8723bs; confirm by inspecting OnBeacon ESR IE handling for length validation before offset accesses and test with crafted beacon frames.

Typical attack path

1. Position a wireless transmitter near the target device
2. Transmit a beacon frame with ESR IE at the buffer boundary
3. Trigger OnBeacon parsing in the rtl8723bs driver
4. Induce out-of-bounds read leading to kernel panic or crash

How to detect it

Review kernel logs for oops/panic entries mentioning OnBeacon, ESR IE, or rtl8723bs; correlate with wireless interface activity around the time of any crash.

What your security team should do

• Prioritize kernel upgrade on systems exposing the rtl8723bs driver to untrusted wireless networks
• Monitor for kernel oops or panic logs referencing OnBeacon or ESR IE
• Disable the rtl8723bs driver if wireless functionality is not required