CVE-2026-43159 Overview
CVE-2026-43159 is a null pointer dereference vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in the find_network code path, where the variable pwlan can be NULL when passed into rtw_free_network_nolock(). The downstream function then dereferences the pointer without validation, leading to a kernel crash.
The issue affects systems using the Realtek RTL8723BS wireless chipset driver, commonly found in low-cost laptops, tablets, and embedded devices. The vulnerability has been resolved across multiple stable kernel branches.
Critical Impact
Triggering the null dereference in rtw_free_network_nolock() causes a kernel oops, resulting in denial of service on affected Linux systems running the rtl8723bs staging driver.
Affected Products
- Linux kernel — drivers/staging/rtl8723bs Wi-Fi driver
- Devices using the Realtek RTL8723BS wireless chipset
- Multiple stable kernel branches (see referenced kernel.org commits)
Discovery Timeline
- 2026-05-06 - CVE-2026-43159 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43159
Vulnerability Analysis
The vulnerability exists in the rtl8723bs staging driver responsible for managing Realtek RTL8723BS Wi-Fi adapters on Linux. During wireless network management operations, the find_network logic returns a pointer to a pwlan (wireless LAN entry) structure. This pointer can legitimately be NULL when no matching network is located in the internal queue.
The code passes pwlan directly into rtw_free_network_nolock() without first validating that the pointer is non-NULL. Inside the callee, fields of the structure are accessed, dereferencing the NULL pointer and triggering a kernel oops. This is classified as a Null Pointer Dereference [CWE-476].
The fix introduces a NULL check before invoking rtw_free_network_nolock(), ensuring the function is only called with a valid pwlan reference.
Root Cause
The root cause is missing input validation in the caller. The find_network routine does not guarantee a non-NULL return value, but the caller assumed the pointer was always valid. Defensive programming around return values from lookup functions was absent in this code path.
Attack Vector
The attack vector is local. An attacker requires the ability to interact with the wireless stack, typically through privileged operations or by inducing specific Wi-Fi state transitions on a system using the RTL8723BS driver. Successful exploitation results in a kernel crash and denial of service. No remote code execution path has been disclosed.
No verified proof-of-concept code is available. The vulnerability mechanism is described in the upstream kernel commits referenced by kernel.org.
Detection Methods for CVE-2026-43159
Indicators of Compromise
- Kernel oops or panic messages referencing rtw_free_network_nolock or find_network in dmesg or /var/log/kern.log.
- Unexpected wireless interface resets or driver reloads on systems using the r8723bs module.
- System crashes correlated with Wi-Fi scan, association, or disconnect events.
Detection Strategies
- Inventory Linux hosts loading the r8723bs kernel module using lsmod | grep r8723bs and verify kernel versions against patched stable releases.
- Monitor kernel ring buffer logs for null pointer dereference signatures within wireless driver call stacks.
- Correlate host crash telemetry with wireless subsystem events to identify exploitation attempts or unstable hardware.
Monitoring Recommendations
- Forward kernel logs and crash dumps to a centralized logging or SIEM platform for retention and analysis.
- Alert on repeated kernel oops events on the same host within a short interval.
- Track kernel version drift across the fleet to identify hosts running unpatched staging drivers.
How to Mitigate CVE-2026-43159
Immediate Actions Required
- Apply the latest stable Linux kernel update for your distribution that incorporates the upstream fix for the rtl8723bsfind_network null dereference.
- Identify all hosts loading the r8723bs driver and prioritize them for patching.
- If patching is delayed, restrict local access to affected systems and disable the wireless interface where feasible.
Patch Information
The vulnerability is resolved by upstream commits to the Linux kernel stable tree. Affected branches received corresponding backports. Reference the patch commits at kernel.org commit 04d24a36, commit 1aa9c59f, commit 3b1d0c9a, commit 41460a19, commit 48b4dec3, commit 677490a6, commit 7fa16ffe, and commit cc3f83b6. Update to a kernel build that includes the relevant commit for your branch.
Workarounds
- Blacklist the r8723bs module on systems that do not require RTL8723BS Wi-Fi functionality by adding blacklist r8723bs to /etc/modprobe.d/.
- Disable the wireless interface administratively until the patched kernel is deployed.
- Restrict local user access and limit unprivileged interaction with the wireless subsystem.
# Configuration example
# Blacklist the vulnerable staging driver until patching is complete
echo "blacklist r8723bs" | sudo tee /etc/modprobe.d/blacklist-r8723bs.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep r8723bs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
