CVE-2025-68256

What it actually does

The rtw_get_ie() parser in the rtl8723bs staging driver accepts an IE length byte without checking whether the declared body fits in the remaining frame buffer, allowing pointer advancement past the end of allocated memory and resulting in out-of-bounds reads or an infinite loop on malformed 802.11 frames.

Why it matters to the business

Wireless-enabled Linux systems may experience kernel crashes, denial of service, or limited information disclosure when processing attacker-controlled 802.11 management frames, increasing operational risk for devices using the rtl8723bs driver until patched kernels are deployed.

How an attack unfolds

An attacker crafts a malformed 802.11 management frame containing an information element whose length field exceeds the actual remaining data in the frame, transmits the frame to a vulnerable device, and causes the kernel's rtw_get_ie() parser to read past the buffer end or loop indefinitely when the frame is processed.

How to fix it

Upgrade the Linux kernel on Debian 12 to version 6.1.128-1 or later; apply the same patch or equivalent fix in any downstream kernel trees that include the rtl8723bs staging driver.

How to confirm the fix worked

Confirm the running kernel version is at least 6.1.128-1, then replay a test frame containing an IE whose declared length exceeds the buffer to verify the parser now safely terminates without OOB access.

Typical attack path

1. Craft 802.11 management frame with oversized IE length field
2. Transmit frame over the air to target device using rtl8723bs driver
3. Trigger IE parsing in rtw_get_ie() during frame reception
4. Induce out-of-bounds read or infinite loop in kernel context

How to detect it

Review kernel logs for oops or panic messages originating from rtl8723bs or rtw_get_ie, and correlate wireless frame reception events with unexpected driver restarts or system instability.

What your security team should do

• Prioritize kernel upgrade to 6.1.128-1 on all Debian 12 systems using rtl8723bs wireless hardware
• Disable the rtl8723bs driver where wireless functionality is not required
• Monitor vendor kernel update channels for backported fixes in other distributions