CVE-2026-43387: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43387 Overview

CVE-2026-43387 affects the Linux kernel staging driver for the Realtek rtl8723bs wireless chipset. The flaw resides in the rtw_get_ie_ex() parser, which fails to properly validate the length of information element (IE) data contained in received wireless frames. Because the driver trusts attacker-controlled frame data without sufficient bounds checking, the parser can read beyond intended buffer boundaries. The Linux kernel maintainers resolved the issue by applying length validation analogous to the earlier fix in commit 154828bf9559 ("staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser").

Critical Impact
A nearby attacker transmitting crafted 802.11 management frames can trigger an out-of-bounds read in kernel memory, potentially causing information disclosure or kernel instability on systems using the rtl8723bs wireless driver.

Affected Products

Linux kernel drivers/staging/rtl8723bs wireless driver
Systems using Realtek RTL8723BS SDIO Wi-Fi hardware (common on low-cost laptops, tablets, and single-board computers)
Linux kernel stable branches prior to the commits listed in the vendor references

Discovery Timeline

2026-05-08 - CVE-2026-43387 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43387

Vulnerability Analysis

The rtw_get_ie_ex() function is part of the rtl8723bs staging driver and parses 802.11 information elements from received wireless frames. Information elements use a Type-Length-Value (TLV) structure, where a single length byte declares how much data follows. The vulnerable code path acts on the declared length without verifying that the declared value fits within the actual frame buffer. This is an Out-of-Bounds Read class issue rooted in improper input validation of untrusted external data.

The fix mirrors the earlier hardening applied in commit 154828bf9559, which addressed the equivalent flaw in rtw_get_ie(). The corrected logic verifies the remaining buffer length before iterating into IE payload bytes, preventing reads past the end of the frame.

Root Cause

The root cause is missing length validation in the IE parser. The driver consumed the TLV length field from an untrusted radio frame and used it to advance a pointer or perform memory comparisons without bounding it against the remaining buffer size. Frame data originates from radio reception, so any nearby device can shape the input.

Attack Vector

An attacker within wireless range can craft and transmit malformed 802.11 frames carrying truncated or oversized information elements. When a vulnerable host parses the frame through rtw_get_ie_ex(), the parser reads adjacent kernel memory. The likely outcomes are kernel information leakage through downstream processing, denial of service via panic on invalid access, or use as a primitive within a larger exploit chain. No authentication or user interaction is required because association is not necessary to receive and process management frames.

No verified public exploit code is available. See the upstream commits referenced below for the technical fix:

Detection Methods for CVE-2026-43387

Indicators of Compromise

Unexpected kernel oops or panic messages referencing rtw_get_ie_ex, rtl8723bs, or r8723bs in dmesg or /var/log/kern.log.
KASAN reports identifying out-of-bounds reads within the rtl8723bs module on instrumented kernels.
Repeated wireless driver resets or interface flapping coinciding with the presence of unknown nearby 802.11 transmitters.

Detection Strategies

Inventory Linux endpoints that load the r8723bs module using lsmod | grep r8723bs and compare kernel versions against the patched stable releases referenced by the upstream commits.
Enable kernel address sanitization (KASAN) in test fleets to catch out-of-bounds reads in wireless driver code during pre-production validation.
Monitor kernel log telemetry for crash signatures originating in the staging wireless driver and forward those events to a central analytics pipeline.

Monitoring Recommendations

Forward kern.log and dmesg output to a centralized log platform and alert on stack traces containing rtl8723bs symbols.
Track wireless interface state transitions on affected hardware to identify abnormal disconnect or reset frequency.
Audit kernel package versions across the fleet on a recurring schedule to confirm patched builds are deployed.

How to Mitigate CVE-2026-43387

Immediate Actions Required

Update affected Linux systems to a kernel build that includes the upstream fixes referenced in commits 35969c3, 6d62fa5, 740bca8, 8097a48, 821f7d7, 9a4cd4c, ac38856, and f0109b9.
Where patching cannot be performed immediately, unload the driver with modprobe -r r8723bs and blacklist it on systems that do not require the affected wireless hardware.
Restrict use of rtl8723bs-based devices to trusted RF environments until the patched kernel is deployed.

Patch Information

The Linux kernel maintainers have merged the fix across multiple stable branches. Apply distribution kernel updates that incorporate the commits listed in the kernel.org stable tree references. After installation, reboot to ensure the new kernel and module are active, and verify with uname -r and modinfo r8723bs.

Workarounds

Blacklist the driver by adding blacklist r8723bs to /etc/modprobe.d/blacklist-rtl8723bs.conf and regenerating the initramfs.
Replace RTL8723BS hardware with a wireless adapter that uses an actively maintained, non-staging driver where feasible.
Disable wireless interfaces on systems that do not require Wi-Fi connectivity, particularly on fixed-location servers or kiosks.

bash

# Configuration example: disable the vulnerable driver
echo "blacklist r8723bs" | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo modprobe -r r8723bs
sudo update-initramfs -u
# Verify the module is no longer loaded
lsmod | grep r8723bs