CVE-2026-53179

What it actually does

This is a Linux kernel buffer over-read in the staging Realtek RTL8723BS wireless driver. The vulnerable rtw_update_protection() routine is called with a pointer that already points inside an 802.11 information-element buffer, but it is still given the original full buffer length. As a result, malformed or specially crafted wireless management data can cause the driver to read beyond the valid end of the buffer while running in kernel context. The most likely outcomes are kernel memory disclosure through diagnostic paths or a kernel crash/denial of service; reliable privilege escalation or code execution is not indicated by the available information.

Why it matters to the business

Systems using the affected Realtek RTL8723BS Wi-Fi driver may be exposed to crashes or instability when processing malicious nearby wireless traffic. Because exploitation requires the vulnerable driver and likely radio proximity, and because EPSS is low, the broad internet-wide risk is limited; however, affected laptops, tablets, embedded Linux devices, and IoT systems using this chipset could experience operational disruption. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has no public exploit maturity reported, so remediation should be handled through normal kernel patch management unless the driver is present on sensitive or highly available devices.

How an attack unfolds

An attacker first identifies or positions near a device using the Linux rtl8723bs wireless driver. The attacker then transmits crafted 802.11 management frames or network information elements that influence the parsing path leading to rtw_update_protection(). Because the vulnerable code receives an offset pointer but an overly large length, the driver may read past the end of the intended buffer. If the over-read touches invalid memory, the system may log a kernel warning, KASAN finding, oops, or panic, causing a denial of service. If the over-read reaches adjacent memory and that data is later exposed through logs, debug paths, or driver behavior, limited kernel memory disclosure may be possible. There is no evidence from the supplied data that this vulnerability is actively exploited in the wild.

How to fix it

Update to a Linux kernel version or distribution kernel package that includes the fix for the rtl8723bs rtw_update_protection() buffer over-read. If a fixed kernel is not yet available from the operating system vendor, apply the upstream kernel patch through the normal kernel maintenance process after compatibility testing. Where immediate patching is not possible, reduce exposure by disabling Wi-Fi on affected systems, unloading or blacklisting the rtl8723bs module if the hardware is not required, using an alternate supported network adapter, and avoiding automatic connection to untrusted wireless networks. Because no exact affected or fixed package versions were provided, rely on distribution advisories, kernel changelogs, and vendor errata to identify the first fixed package for each supported platform.

How to confirm the fix worked

Confirm whether the rtl8723bs driver is present or loaded by checking kernel modules and hardware inventory. Validate remediation by confirming the running kernel package includes the vendor fix for this CVE or the upstream change correcting the rtw_update_protection() length calculation. After patching and rebooting, confirm the active kernel is the updated kernel, the vulnerable module was rebuilt or replaced, and no older vulnerable kernel remains as the default boot option. For source-based validation, inspect the rtl8723bs driver implementation and verify rtw_update_protection() is passed the remaining IE buffer length rather than the original full ie_length after the pointer offset. Monitor kernel logs after remediation for absence of new KASAN, oops, panic, or rtl8723bs-related over-read messages during wireless association and roaming events.

Typical attack path

1. Find a target device that uses the Linux rtl8723bs Realtek wireless driver.
2. Move within Wi-Fi radio range or operate a malicious access point or frame-injection device near the target.
3. Send crafted 802.11 management frames or information elements designed to reach the rtw_update_protection() parsing path.
4. Trigger the incorrect length handling condition where the driver reads beyond the valid IE buffer boundary.
5. Cause a kernel warning, crash, or possible limited information exposure depending on kernel hardening, logging, and memory layout.

How to detect it

Look for signs of prior exploitation or attempted triggering in kernel and system logs, especially around Wi-Fi association, roaming, scanning, or access point changes. Relevant sources include dmesg, journald, /var/log/kern.log, /var/log/messages, crash dump records, pstore/ramoops, kdump/vmcore metadata, and endpoint telemetry that records kernel panics or module faults. Search for KASAN or kernel oops messages involving rtl8723bs, rtw_update_protection(), rtw_mlme_ext, information-element parsing, slab out-of-bounds reads, or general protection faults occurring during wireless activity. Because wireless frames are often not captured by default, absence of network logs does not prove absence of attempts; RF packet captures from monitors in the area may help if available. There are no known public threat actors or ransomware campaigns associated with this issue in the supplied data.

• rtw_update_protection
• rtl8723bs
• 8723bs
• BUG: KASAN: slab-out-of-bounds in rtw_update_protection
• BUG: KASAN: out-of-bounds in rtw_update_protection
• slab-out-of-bounds Read in rtw_update_protection
• kernel BUG at drivers/staging/rtl8723bs
• drivers/staging/rtl8723bs
• general protection fault: 0000 [#1]
• Oops: 0000
• Kernel panic - not syncing
• Call Trace: rtw_update_protection
• rtw_update_protection+
• rtl8723bs:
• /sys/module/rtl8723bs
• /lib/modules/*/kernel/drivers/staging/rtl8723bs/rtl8723bs.ko
• /var/log/kern.log
• /var/log/messages
• /sys/fs/pstore
• /var/crash

What your security team should do

• Inventory Linux systems for the rtl8723bs driver or Realtek RTL8723BS wireless hardware, prioritizing mobile, embedded, and edge devices.
• Apply the vendor-provided fixed kernel package once available, and ensure systems reboot into the fixed kernel.
• For systems that cannot be patched promptly, disable or blacklist the rtl8723bs module where Wi-Fi is not business-critical.
• Prioritize remediation higher for devices operating in public, shared, or hostile RF environments where nearby wireless frame injection is plausible.
• Add monitoring for rtl8723bs kernel faults, KASAN findings, oops events, and unexpected reboots until all affected systems are remediated.
• Review operating system vendor advisories because fixed versions vary by distribution and no exact package versions were supplied.
• Do not treat the issue as an emergency internet-facing mass-exploitation risk based solely on current intelligence, but include it in routine kernel security update cycles.