CVE-2025-68255

What it actually does

The flaw allows direct use of an unvalidated Supported Rates IE length from an Association Request frame in a memcpy to a 16-byte stack buffer in the rtl8723bs driver, enabling stack buffer overflow; a secondary bounds-check error exists when merging Extended Supported Rates.

Why it matters to the business

Kernel stack corruption on affected wireless devices can cause crashes, denial of service, or potential code execution; low and stable EPSS with no KEV listing indicates limited observed in-the-wild risk, though wireless Linux systems remain exposed until patched.

How an attack unfolds

An attacker crafts a malicious 802.11 Association Request containing a Supported Rates IE longer than 16 bytes and sends it to a target using the vulnerable rtl8723bs driver; the OnAssocReq handler copies the oversized IE without clamping, overflowing the stack buffer and corrupting kernel memory.

How to fix it

Upgrade affected chromium (Debian:12) packages to version 133.0.6943.126-1~deb12u1; apply the upstream fix that clamps ie_len to buffer size and corrects the Extended Supported Rates bounds check before merging.

How to confirm the fix worked

Confirm the installed package version matches or exceeds 133.0.6943.126-1~deb12u1; verify kernel source contains the clamping of ie_len and corrected bounds check for Extended Supported Rates before memcpy operations.

Typical attack path

1. Craft 802.11 Association Request frame with Supported Rates IE length >16 bytes
2. Transmit frame to target device running vulnerable rtl8723bs driver
3. Driver parses frame in OnAssocReq and performs unbounded memcpy
4. Stack buffer overflows leading to kernel memory corruption

How to detect it

Review kernel logs for stack canary violations or oops messages originating from rtl8723bs OnAssocReq; inspect wireless packet captures for Association Request frames containing Supported Rates IEs exceeding 16 bytes.

What your security team should do

• Prioritize patching chromium (Debian:12) to 133.0.6943.126-1~deb12u1 on all systems using rtl8723bs wireless drivers
• Monitor for wireless association frames with anomalous IE lengths via network monitoring
• Test driver behavior with crafted oversized Supported Rates IEs in a lab environment