CVE-2026-43386 Overview
CVE-2026-43386 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's rtl8723bs staging wireless driver. The flaw resides in the rtw_restruct_wmm_ie function, which processes Wi-Fi Multimedia (WMM) information elements during association handling. The function accesses in_ie[i + 5] before validating that i + 5 < in_len, allowing the code to read past the bounds of the input buffer. Linux kernel maintainers have resolved the issue by moving the length check before the array access. Multiple stable kernel branches received corresponding patches.
Critical Impact
An out-of-bounds read in the kernel-mode wireless driver can leak adjacent kernel memory contents or trigger kernel instability when parsing crafted WMM information elements during Wi-Fi association.
Affected Products
- Linux kernel drivers/staging/rtl8723bs driver (Realtek RTL8723BS SDIO Wi-Fi)
- Multiple stable Linux kernel branches receiving backported fixes
- Distributions shipping the staging rtl8723bs driver module
Discovery Timeline
- 2026-05-08 - CVE-2026-43386 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43386
Vulnerability Analysis
The vulnerability exists in the rtw_restruct_wmm_ie function within the rtl8723bs staging wireless driver. The function iterates through an information element (IE) buffer received during Wi-Fi association processing. The original code performed the length validation i + 5 < in_len at the end of the conditional block, after the code had already dereferenced in_ie[i + 5]. This ordering allows a read access at index i + 5 even when that index lies beyond the declared in_len buffer length.
An attacker within radio range can supply a crafted WMM information element shorter than expected. The driver then reads bytes from kernel memory beyond the allocated buffer. The data accessed may include uninitialized stack contents, adjacent heap metadata, or unrelated allocations, depending on kernel memory layout.
Root Cause
The root cause is incorrect ordering of bounds validation relative to array indexing. The conditional logic dereferenced in_ie[i + 5] before confirming that the index remained within in_len. This is a classic check-after-use pattern that defeats the intent of the bounds guard.
Attack Vector
Exploitation requires the target system to process a malformed WMM IE through the rtl8723bs driver during Wi-Fi association or scan handling. A nearby attacker operating a rogue access point or beacon source can supply the crafted frame. The vulnerability is a read primitive only and does not directly grant code execution.
No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream kernel commits; see the kernel.org patch references for the corrected length-check ordering.
Detection Methods for CVE-2026-43386
Indicators of Compromise
- Kernel log entries referencing rtl8723bs driver faults, KASAN reports, or slab-out-of-bounds warnings during Wi-Fi association
- Unexpected kernel oops or call traces involving rtw_restruct_wmm_ie symbols
- Repeated association failures from nearby unknown SSIDs targeting affected hardware
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test or canary systems to surface out-of-bounds reads in the staging driver
- Inventory deployed kernels and identify systems loading the rtl8723bs module via lsmod and package management telemetry
- Compare running kernel versions against the patched stable branches referenced in the kernel.org commits
Monitoring Recommendations
- Forward dmesg and journalctl kernel logs to a centralized log platform for correlation of driver crashes
- Alert on kernel panics or repeated wireless stack faults on systems using Realtek RTL8723BS chipsets
- Track unusual Wi-Fi disassociation or association loops on embedded and IoT devices that commonly ship the affected driver
How to Mitigate CVE-2026-43386
Immediate Actions Required
- Apply the latest stable Linux kernel update from your distribution that incorporates the upstream fix
- Unload the rtl8723bs module on systems that do not require Realtek RTL8723BS Wi-Fi connectivity using modprobe -r rtl8723bs
- Restrict use of vulnerable devices to trusted wireless environments until patches are deployed
Patch Information
The Linux kernel maintainers committed fixes across multiple stable branches. Reference commits include 12cc6e8f8d42, 209644e25757, 4dd2d9cf563c, 6ff2243d5e05, 768f25613a9f, a75281626fc8, d97fc1b29513, and e14a1148f02e. The fix relocates the i + 5 < in_len length check before any access to in_ie[i + 5].
Workarounds
- Blacklist the rtl8723bs module where Wi-Fi via this chipset is not needed by adding blacklist rtl8723bs to /etc/modprobe.d/
- Disable Wi-Fi or remove the affected USB/SDIO adapter on systems operating in untrusted RF environments
- Use wired networking or alternative wireless hardware until the patched kernel is deployed
# Blacklist the vulnerable driver until a patched kernel is installed
echo "blacklist rtl8723bs" | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo modprobe -r rtl8723bs
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
