CVE-2026-43387

What it actually does

This vulnerability is an improper input validation flaw in the Linux kernel staging rtl8723bs wireless driver. The driver’s rtw_get_ie_ex() parser can trust malformed 802.11 frame information-element length fields without sufficient bounds checking, which can cause an out-of-bounds read while parsing wireless frame data. Based on the assigned CVSS vector, exploitation requires local access and low privileges, does not require user interaction, and primarily affects availability; the expected impact is a kernel crash, oops, panic, or denial of service rather than data theft or privilege escalation.

Why it matters to the business

Systems using affected Linux kernels with the rtl8723bs wireless driver may be vulnerable to local denial-of-service conditions that can interrupt endpoint, embedded, kiosk, IoT, or appliance operations. The current EPSS score is very low, the issue is not listed in CISA KEV, and no public exploit maturity is indicated, so broad active exploitation is not currently suggested; however, organizations with fleets that rely on this wireless chipset should still patch through normal kernel update processes because kernel crashes can cause operational downtime and service disruption.

How an attack unfolds

An attacker first needs local access to a system running an affected Linux kernel where the rtl8723bs driver is present and in use or loadable. The attacker then causes the driver to process specially malformed wireless frame or information-element data with inconsistent or invalid length fields. Because vulnerable versions do not sufficiently validate the supplied frame data before parsing it in rtw_get_ie_ex(), the kernel may read past the valid buffer boundary. The most likely result is a kernel fault, oops, panic, or system hang, producing a denial of service. There is no indication from the provided scoring or description that the flaw enables remote code execution, privilege escalation, or direct data disclosure.

How to fix it

Apply a Linux kernel update that includes the upstream fix for the rtl8723bs rtw_get_ie_ex() bounds validation issue. Because fixed package versions were not provided, use the latest security-supported kernel from the relevant Linux distribution, vendor, or device firmware provider and verify that the vendor advisory explicitly includes this CVE or the corresponding rtl8723bs parser fix. Where immediate patching is not possible, reduce exposure by disabling or unloading the rtl8723bs driver if the hardware is not required, blacklisting the module, disabling affected wireless interfaces, or replacing unsupported staging-driver-based wireless configurations with supported hardware and drivers. Reboot systems after kernel updates unless live patching is explicitly supported and confirmed to cover this issue.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version after reboot with standard system inventory commands and comparing it against the vendor’s fixed kernel advisory. Check whether the rtl8723bs module is present or loaded using module inventory tooling such as lsmod, modinfo, or distribution package metadata. Validate that the applied kernel source or vendor changelog contains the rtl8723bs rtw_get_ie_ex() input-length validation fix. For mitigation-only cases, confirm that the rtl8723bs module cannot be loaded and that affected wireless interfaces are disabled. Review kernel logs after update or mitigation to ensure there are no recurring rtl8723bs-related oops, panic, KASAN, UBSAN, or page fault messages during wireless scanning or association activity.

Typical attack path

1. Identify a Linux system running an affected kernel with the rtl8723bs wireless driver available or active.
2. Obtain low-privileged local access to the system.
3. Trigger wireless parsing behavior by causing the driver to process crafted or malformed 802.11 information-element data.
4. Exploit insufficient bounds validation in rtw_get_ie_ex() to cause an out-of-bounds read in kernel context.
5. Cause a kernel oops, panic, crash, or system instability resulting in denial of service.

How to detect it

To investigate possible prior exploitation, review kernel logs, system journals, crash dumps, and endpoint telemetry for crashes or memory-safety errors involving the rtl8723bs driver or rtw_get_ie_ex() function. Relevant log sources include dmesg output, /var/log/kern.log, /var/log/messages, /var/log/syslog, systemd journal entries for the kernel, kdump/vmcore artifacts, pstore/ramoops logs on embedded systems, and EDR telemetry for kernel panic or unexpected reboot events. Look for KASAN or UBSAN reports, kernel oops traces, general protection faults, page faults, NULL pointer or slab out-of-bounds messages with call traces containing rtl8723bs, rtw_get_ie_ex, rtw_get_ie, or related rtw_* parsing functions. Correlate events with wireless scanning, association, roaming, or suspicious local user activity. Because the vulnerability primarily causes denial of service and no public exploit indicators are provided, detection is behavioral and artifact-based rather than based on a unique exploit payload.

• rtw_get_ie_ex
• rtw_get_ie
• rtl8723bs
• r8723bs
• staging: rtl8723bs
• KASAN: slab-out-of-bounds
• KASAN: out-of-bounds
• BUG: KASAN
• kernel BUG
• Oops:
• Kernel panic
• general protection fault
• unable to handle kernel paging request
• Call Trace:
• /var/log/kern.log
• /var/log/messages
• /var/log/syslog
• /sys/module/rtl8723bs
• /lib/modules/*/kernel/drivers/staging/rtl8723bs
• rtl8723bs.ko
• rtl8723bs.ko.xz
• rtl8723bs.ko.zst

What your security team should do

• Prioritize patching systems that use the rtl8723bs wireless driver, especially embedded, mobile, kiosk, operational, or unattended systems where crashes create service disruption.
• Use asset inventory to identify Linux endpoints and appliances with the rtl8723bs module installed, loaded, or required by hardware.
• Update to the latest vendor-supported kernel or firmware image that includes the rtl8723bs parser validation fix.
• If patching must be delayed, disable or blacklist the rtl8723bs driver where operationally feasible.
• Monitor kernel logs for rtl8723bs, rtw_get_ie_ex(), out-of-bounds read, KASAN, oops, panic, and page fault events that may indicate attempted triggering or instability.
• Treat repeated crashes involving rtl8723bs during wireless activity as potentially suspicious and preserve kernel logs, crash dumps, and wireless event logs for investigation.
• Because this issue is not currently KEV-listed and has a low EPSS score, handle it through normal vulnerability management unless affected systems are mission-critical or repeatedly unstable.