CVE-2026-68190
NoneCVSS
—
EPSS
0.2%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A coding mistake in a Linux wireless driver could let specially crafted network signals read memory they should not, risking data leaks or crashes on affected devices.
- Exploitation
- Adjacent Network
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds read in rtw_get_wps_ie allowing reads of in_ie[cnt+1] and cnt+2 plus arbitrary-length payload access without verifying the IE header or declared length fit inside the supplied buffer from network frames.
Why it matters to the business
Low-probability information disclosure or kernel instability affecting Linux systems using the rtl8723bs wireless driver; limited real-world impact given low EPSS, absence from KEV, and 76-day publication age with no known threat-actor exploitation.
How an attack unfolds
An attacker crafts wireless management frames containing truncated or oversized WPS information elements and delivers them to a target running the vulnerable rtl8723bs staging driver; the absence of header and length validation in the parsing loop causes memory reads past the end of the input buffer.
How to fix it
Apply the upstream kernel patch that inserts bounds checks at the top of the rtw_get_wps_ie loop (require ≥2 bytes for IE header and payload length ≤ remaining buffer, plus ≥4 bytes before WPS OUI comparison) and rebuild or upgrade to a kernel containing the fix.
How to confirm the fix worked
Inspect the rtw_get_wps_ie function in drivers/staging/rtl8723bs for the added early-exit checks on remaining buffer length before any in_ie[cnt+1] or memcmp access; confirm the module no longer performs unbounded reads on crafted IE data.
Typical attack path
- Transmit malformed 802.11 frames embedding WPS IEs with invalid length fields
- Force the rtl8723bs driver to invoke rtw_get_wps_ie on the received buffer
- Trigger successive out-of-bounds reads of IE header bytes and payload
- Observe resulting kernel memory disclosure or oops
How to detect it
Search kernel logs and crash dumps for rtl8723bs oops or warnings originating from rtw_get_wps_ie; inspect inbound 802.11 management frames containing WPS IEs for length anomalies that would have triggered the missing bounds checks.
What your security team should do
- Prioritize kernel updates for systems exposing the rtl8723bs driver
- Blacklist or disable the rtl8723bs staging module where 802.11 functionality is not required
- Review wireless network configurations to reduce exposure to untrusted frames
The record
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - in_ie[cnt + 1] is read without checking cnt + 1 < in_len - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check - in_ie[cnt + 1] is used as length without verifying payload fits Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer. Also require at least 4 bytes of payload before comparing the WPS OUI.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|