Cloudanix VulnDB

CVE-2026-98160

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding error in the Linux kernel's handling of certain wireless chips can cause computers to crash under specific conditions.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Incorrect kfree() on vzalloc()-allocated HalData buffer in rtw_sdio_if1_init() error path causes memory corruption in the Linux kernel rtl8723bs driver.

Why it matters to the business

May trigger kernel instability or crashes on systems with RTL8723BS SDIO wireless hardware, resulting in denial of service for affected Linux deployments.

How an attack unfolds

A local attacker forces the driver initialization error path to release vmalloc-backed memory using the wrong allocator, leading to heap corruption.

How to fix it

Replace the erroneous kfree() call with rtw_hal_data_deinit() (which uses vfree()) in the rtw_sdio_if1_init() error path; apply the upstream fix once available in mainline kernels.

How to confirm the fix worked

Review the rtw_sdio_if1_init() function in drivers/staging/rtl8723bs to confirm HalData is freed exclusively via the paired deinit helper rather than kfree().

Typical attack path

  1. Gain local user access on a Linux system using the rtl8723bs driver
  2. Trigger an error condition during SDIO interface initialization
  3. Invoke the mismatched free operation to corrupt kernel memory

How to detect it

Search kernel logs and crash dumps for memory-management faults or warnings referencing rtw_sdio_if1_init, HalData, or mismatched alloc/free in the rtl8723bs staging driver.

What your security team should do

  • Prioritize kernel updates containing the memory-management fix for all systems exposing the rtl8723bs driver
  • Restrict local access on unpatched hosts until remediation is applied
  • Monitor kernel logs for oops or corruption reports involving HalData or rtl8723bs

The record

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalData is allocated via vzalloc(), but incorrectly freed using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to release this vmalloc-backed buffer can lead to memory corruption. Use rtw_hal_data_deinit() to pair the free correctly and free HalData with vfree(). The bug was first flagged by an experimental static analysis tool we are developing for kernel memory-management bugs. Manual inspection confirms that the issue is still present in current mainline. An x86_64 allyesconfig build showed no new warnings. As we do not have suitable RTL8723BS SDIO hardware to test with, no runtime testing was able to be performed.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities