CVE-2026-43159

What it actually does

This is a local denial-of-service flaw in the Linux kernel staging rtl8723bs wireless driver. A NULL pointer can be passed into rtw_free_network_nolock() from find_network(), leading to a kernel NULL pointer dereference. If the vulnerable driver is present and reachable, a local user with the ability to exercise the affected wireless-driver code path can trigger a kernel oops or panic, causing loss of system availability. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, and high availability impact, with no expected confidentiality or integrity impact.

Why it matters to the business

Systems using the affected Linux kernel driver may be crashed by a local low-privileged user or process, potentially causing workstation, embedded device, kiosk, appliance, or edge-system downtime. The risk is highest for systems that include or load the rtl8723bs staging Wi-Fi driver, particularly devices dependent on wireless connectivity or deployed in operational environments where reboot-induced downtime is disruptive. EPSS is currently very low and there is no known CISA KEV listing or ransomware association, so this should generally be prioritized as routine kernel maintenance unless the affected driver is widely deployed in critical systems.

How an attack unfolds

An attacker first needs local access to a Linux system running a vulnerable kernel build with the rtl8723bs staging wireless driver present and usable. The attacker then invokes or manipulates wireless-driver behavior so the find_network() logic reaches a state where the pwlan pointer is NULL but is still passed to rtw_free_network_nolock(). When the kernel later dereferences that NULL pointer, the system records a kernel oops and may panic or become unstable depending on kernel panic settings and workload. Successful exploitation does not provide code execution or privilege escalation based on the available description; the practical outcome is denial of service through a crash or forced reboot.

How to fix it

Update the Linux kernel to a vendor-supported version that includes the upstream fix for the rtl8723bs find_network NULL dereference. Because no exact fixed versions were provided, use the relevant Linux distribution, appliance, or device-vendor advisory to identify the corrected kernel package for each platform. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the rtl8723bs driver if it is not required, removing affected Realtek RTL8723BS wireless hardware from high-criticality systems where feasible, limiting local shell access to trusted users, and ensuring kernel panic/reboot behavior aligns with operational recovery requirements. Avoid relying on mitigations alone for systems that require the affected driver.

How to confirm the fix worked

Confirm the installed kernel package is at or above the vendor-fixed version once published by the applicable distribution or device vendor. Check whether the affected driver is present or loaded using commands such as lsmod, modinfo rtl8723bs, and filesystem searches under /lib/modules/$(uname -r)/ for rtl8723bs. Validate mitigation by confirming the module is not loaded and is blacklisted where the driver is unnecessary. After patching, review kernel changelogs or vendor advisories for the rtl8723bs find_network or rtw_free_network_nolock fix, reboot into the updated kernel, and confirm the running kernel with uname -r rather than only checking installed packages.

Typical attack path

1. Gain local access to a Linux system with low-privileged user permissions.
2. Confirm the system is running a vulnerable Linux kernel build and has the rtl8723bs staging wireless driver available or loaded.
3. Exercise the affected wireless networking code path associated with find_network().
4. Trigger the condition where a NULL pwlan value is passed to rtw_free_network_nolock().
5. Cause a kernel NULL pointer dereference, producing a kernel oops, panic, crash, or reboot.

How to detect it

To determine whether this was already exploited, review host kernel logs and crash artifacts for evidence of NULL pointer dereferences or kernel oops events involving the rtl8723bs driver, find_network(), or rtw_free_network_nolock(). Relevant sources include journalctl -k output, /var/log/kern.log, /var/log/messages, /var/log/syslog, dmesg output, persistent systemd journal records, kdump/vmcore crash dumps, apport/ABRT crash records where used, and remote syslog/SIEM collections. Look for crashes or reboots preceded by wireless-driver activity and followed by boot messages, especially if repeated and associated with local user sessions or suspicious local processes. Because this flaw causes denial of service rather than durable post-exploitation artifacts, absence of persistent IOCs does not prove non-exploitation; correlation should focus on crash timing, kernel stack traces, local login history, command execution telemetry, and module load events for rtl8723bs.

• rtl8723bs
• find_network
• rtw_free_network_nolock
• BUG: kernel NULL pointer dereference
• Oops: 0000
• kernel NULL pointer dereference
• Unable to handle kernel NULL pointer dereference
• Kernel panic - not syncing
• Modules linked in: rtl8723bs
• /lib/modules/$(uname -r)/kernel/drivers/staging/rtl8723bs/
• rtl8723bs.ko

What your security team should do

• Inventory Linux systems and embedded devices to identify hosts running kernels that include the rtl8723bs staging driver.
• Prioritize patching for systems where rtl8723bs is loaded, where local users are untrusted, or where unexpected reboots would affect business operations.
• Apply the appropriate vendor kernel update as soon as it is available; no universal fixed version was provided in the input.
• Disable or blacklist rtl8723bs on systems that do not need Realtek RTL8723BS wireless functionality.
• Restrict local interactive access and untrusted workload execution on potentially affected systems until patched.
• Monitor kernel logs for NULL pointer dereference, oops, panic, or crash events referencing rtl8723bs, find_network, or rtw_free_network_nolock.
• Treat repeated local crashes on affected systems as suspicious until benign hardware, driver, or testing causes are confirmed.