CVE-2026-46305: Linux Kernel NULL Pointer Dereference

CVE-2026-46305 Overview

CVE-2026-46305 is a NULL pointer dereference vulnerability in the Linux kernel's rtl8723bs staging driver. The flaw resides in the rtw_cbuf_alloc function within the os_dep subsystem. The function calls kzalloc_flex() to allocate memory but dereferences the returned pointer without checking whether allocation succeeded. When the kernel is under memory pressure and the allocation returns NULL, the unconditional dereference triggers a kernel oops. The issue affects systems using the Realtek RTL8723BS Wi-Fi chipset, commonly found in low-cost laptops and single-board computers. The upstream kernel maintainers have committed a fix that guards access to the allocated structure.

Critical Impact
A failed memory allocation in the rtl8723bs driver path leads to a kernel NULL pointer dereference, causing a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel versions containing the staging/rtl8723bs driver prior to the referenced fix commits
Systems using Realtek RTL8723BS Wi-Fi/Bluetooth combo modules
Distributions shipping the staging driver tree without the backported patches

Discovery Timeline

2026-06-08 - CVE-2026-46305 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46305

Vulnerability Analysis

The defect sits in the rtw_cbuf_alloc helper inside the Realtek rtl8723bs staging driver. The function allocates a circular buffer structure through kzalloc_flex(), a flexible-array allocator that may return NULL when the kernel cannot satisfy the request. The original code immediately writes to a member of the returned pointer without verifying success. This pattern is a classic NULL pointer dereference [CWE-476] in kernel space.

Kernel-space NULL dereferences typically map to a non-canonical or unmapped virtual address. The CPU raises a page fault that the kernel reports as an oops. The affected task is terminated, and depending on the call context, the system may panic or leave driver state corrupted. The bug is reachable during driver initialization and circular buffer setup paths used by the wireless stack.

The staging tree status of rtl8723bs means the driver has historically received less rigorous review than mainline drivers. Similar allocation-check omissions have appeared across the staging tree and remain a recurring source of stability bugs.

Root Cause

The root cause is missing error handling after a memory allocation call. The driver assumes kzalloc_flex() always succeeds and proceeds to initialize members of the returned object. Under low-memory conditions, the allocator returns NULL and the subsequent member assignment dereferences address zero.

Attack Vector

Exploitation requires conditions that cause allocation failure within the driver's code path. A local attacker with the ability to load the module, trigger Wi-Fi interface operations, or induce memory pressure could reach the vulnerable path. The practical outcome is denial of service through a kernel oops rather than code execution. No remote attack vector or privilege escalation primitive has been documented for this issue.

No verified proof-of-concept code is available for CVE-2026-46305. Technical details of the fix are visible in the upstream commits referenced in the Kernel Git Commit Overview and the secondary stable backport commit.

Detection Methods for CVE-2026-46305

Indicators of Compromise

Kernel oops messages referencing rtw_cbuf_alloc or the rtl8723bs module in dmesg or /var/log/kern.log
Unexpected Wi-Fi interface failures on devices using Realtek RTL8723BS hardware
Repeated kernel page-fault traces with NULL or near-NULL fault addresses originating in staging driver call stacks

Detection Strategies

Inventory hosts running affected kernel versions and confirm whether the r8723bs module is loaded with lsmod | grep r8723bs
Audit kernel logs for BUG: unable to handle kernel NULL pointer dereference entries tied to the staging driver
Correlate Wi-Fi driver crashes with memory-pressure events using system telemetry

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on oops signatures involving rtl8723bs
Track kernel package versions across the fleet and flag systems running unpatched builds
Monitor host availability metrics for unexpected reboots on devices known to use the Realtek chipset

How to Mitigate CVE-2026-46305

Immediate Actions Required

Update the Linux kernel to a version that includes commits 0a5f411becfb and bc851db06045
For systems where patching is delayed, unload the r8723bs module if the Wi-Fi interface is not required
Restrict local access on multi-user systems that retain the vulnerable driver

Patch Information

The fix adds a NULL check on the return value of kzalloc_flex() in rtw_cbuf_alloc so that the structure is only accessed when allocation succeeds. The patches are available in the stable kernel tree via the primary upstream commit and the stable backport. Apply distribution-supplied kernel updates as they become available.

Workarounds

Blacklist the r8723bs module by adding blacklist r8723bs to /etc/modprobe.d/blacklist.conf on systems that do not require the device
Replace affected Realtek RTL8723BS hardware with a supported wireless adapter where feasible
Limit untrusted local users from triggering Wi-Fi interface operations through standard Linux capability and namespace controls

bash

# Blacklist the vulnerable staging driver until the kernel is patched
echo 'blacklist r8723bs' | sudo tee /etc/modprobe.d/disable-rtl8723bs.conf
sudo rmmod r8723bs 2>/dev/null || true
sudo update-initramfs -u