CVE-2026-43225: Linux Kernel Memory Leak Vulnerability

CVE-2026-43225 Overview

CVE-2026-43225 is a memory leak vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in a failure path where cfg80211_inform_bss_frame() may return NULL, causing the previously allocated buf buffer to remain unfreed before the function returns early. Repeated invocation of the affected code path can exhaust kernel memory over time. The Linux kernel maintainers have resolved the issue by ensuring buf is freed on both success and failure paths. The vulnerability was published to the National Vulnerability Database on 2026-05-06.

Critical Impact
A kernel-resident memory leak in the rtl8723bs staging driver allows local triggering of the failure path to gradually consume kernel memory, potentially leading to denial of service on systems using affected Realtek RTL8723BS Wi-Fi hardware.

Affected Products

Linux kernel staging/rtl8723bs driver
Distributions shipping the rtl8723bs Realtek Wi-Fi staging driver
Embedded and ARM systems commonly using RTL8723BS Wi-Fi/Bluetooth modules

Discovery Timeline

2026-05-06 - CVE-2026-43225 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43225

Vulnerability Analysis

The vulnerability exists in the rtl8723bs staging driver located under drivers/staging/rtl8723bs/ in the Linux kernel tree. The driver handles management frame reporting to the cfg80211 subsystem via cfg80211_inform_bss_frame(). Before invoking this helper, the driver allocates a working buffer referenced as buf to construct the frame data.

When cfg80211_inform_bss_frame() returns NULL to indicate failure, the driver's existing logic returns early without releasing buf. Each failed invocation leaks the allocation, and because frame reporting occurs frequently during scanning and association events, the leak can accumulate quickly on active wireless interfaces. The fix introduces an unconditional kfree(buf) so the buffer is released on both the success and failure paths.

Root Cause

The root cause is missing cleanup on an error path, classified as a memory leak [CWE-401]. The driver assumed cfg80211_inform_bss_frame() would always consume or take ownership of related state, but the helper returns NULL under low-memory or invalid-frame conditions, leaving the caller responsible for freeing buf.

Attack Vector

The leak is triggered through normal kernel control flow when the cfg80211 helper fails. A local user or nearby attacker capable of inducing repeated scan, beacon, or probe-response processing failures on a system using the rtl8723bs adapter can drive sustained kernel memory consumption. Exhausting kernel memory may degrade system performance or trigger out-of-memory conditions affecting other workloads.

// No verified exploitation code is available for this issue.
// The vulnerability is a missing kfree(buf) on the failure return
// from cfg80211_inform_bss_frame() within the rtl8723bs staging driver.
// See the upstream patches referenced below for the exact diff.

Detection Methods for CVE-2026-43225

Indicators of Compromise

Steady, unexplained growth in kernel slab allocations on hosts using the rtl8723bs driver, observable via /proc/slabinfo or slabtop.
Increasing MemAvailable pressure correlated with active Wi-Fi scanning or association activity on RTL8723BS devices.
Out-of-memory killer events on long-running systems with the affected driver loaded.

Detection Strategies

Inventory hosts with the rtl8723bs module loaded using lsmod | grep rtl8723bs and compare kernel versions against patched stable releases.
Enable kernel memory leak detection with CONFIG_DEBUG_KMEMLEAK on test systems and review /sys/kernel/debug/kmemleak for reports referencing the staging driver.
Correlate kernel log entries from cfg80211 and rtl8723bs with memory growth metrics in your observability stack.

Monitoring Recommendations

Monitor kernel memory utilization trends on devices using Realtek RTL8723BS hardware and alert on sustained slab growth.
Track distribution security advisories for backports of the upstream commits to long-term support kernels.
Audit which fleet endpoints, especially embedded or single-board systems, depend on the rtl8723bs staging driver and prioritize them for patching.

How to Mitigate CVE-2026-43225

Immediate Actions Required

Apply the patched Linux kernel from your distribution once it incorporates the upstream fix referenced in the kernel.org commits.
Where patching is delayed, restrict use of rtl8723bs-based Wi-Fi adapters on critical systems or replace them with supported hardware.
Reboot affected systems after patch installation to ensure the updated kernel module is loaded.

Patch Information

The Linux kernel maintainers have published fixes across multiple stable branches. Refer to the upstream commits: Kernel Patch 017295b, Kernel Patch 8311bb4, Kernel Patch 9874e33, Kernel Patch 9f70f78, Kernel Patch a968c6a, Kernel Patch abe850d, and Kernel Patch af48c1a. Track your distribution's kernel package updates and install the version that includes these commits.

Workarounds

Blocklist the rtl8723bs module on systems that do not require Wi-Fi by adding blacklist rtl8723bs to /etc/modprobe.d/.
Disable the wireless interface when not in use to reduce the rate at which the failure path can be exercised.
Schedule periodic reboots on systems that must run an unpatched kernel to reclaim leaked kernel memory.

bash

# Check whether the affected staging driver is loaded
lsmod | grep rtl8723bs

# Optionally blacklist the module until a patched kernel is installed
echo 'blacklist rtl8723bs' | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo update-initramfs -u

# Verify the running kernel version after patching
uname -r