CVE-2026-68190: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68190 Overview

CVE-2026-68190 is an out-of-bounds read vulnerability in the Linux kernel rtl8723bs staging Wi-Fi driver. The flaw resides in the rtw_get_wps_ie() function, which parses Information Element (IE) data from received network frames. The function iterates over IE fields without validating that each IE header and its declared payload fit within the remaining buffer. An attacker within wireless range can craft malformed frames that trigger reads past the end of the buffer. The Linux kernel maintainers resolved the issue by adding bounds checks at the top of the parsing loop.

Critical Impact
A malicious wireless frame processed by an affected rtl8723bs adapter can cause the kernel to read memory outside the intended buffer, leading to information disclosure or a kernel crash.

Affected Products

Linux kernel drivers/staging/rtl8723bs wireless driver
Systems using Realtek RTL8723BS SDIO Wi-Fi adapters
Kernel branches tracked by the stable commits referenced in the fix set

Discovery Timeline

2026-08-10 - CVE-2026-68190 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68190

Vulnerability Analysis

The vulnerability is an Out-of-Bounds Read [CWE-125] in rtw_get_wps_ie(), a helper used to locate the Wi-Fi Protected Setup (WPS) Information Element inside 802.11 management frames. Wireless IEs follow a TLV layout where the first byte is the element ID, the second byte is the length, and the payload follows. The function walked this list using an index cnt but never confirmed that the header and payload remained inside the caller-supplied buffer of size in_len.

Three specific unsafe accesses existed. The read of in_ie[cnt + 1] occurred without checking cnt + 1 < in_len. The memcmp(&in_ie[cnt + 2], ...) call accessed offset cnt + 2 without a bounds check. The value at in_ie[cnt + 1] was then used as a payload length without verifying that the payload fit in the remaining buffer.

Root Cause

The root cause is missing input validation on untrusted IE data sourced from over-the-air frames. The parser trusted length fields inside the frame and advanced cnt based on attacker-controlled values. A truncated or crafted IE could push subsequent reads past the buffer end.

Attack Vector

An attacker within radio range of a target using an RTL8723BS adapter can transmit crafted beacon, probe response, or association frames containing malformed IE fields. When the driver parses these frames to search for the WPS OUI, the out-of-bounds read is triggered in kernel context. Impacts include kernel memory disclosure through side effects and potential denial of service via a fault on unmapped pages.

No verified public exploit code is available for this issue. See the Kernel Git Commit 875479f and related stable commits for the exact source-level changes.

Detection Methods for CVE-2026-68190

Indicators of Compromise

Unexpected kernel oops or KASAN: slab-out-of-bounds reports referencing rtw_get_wps_ie in dmesg or journalctl -k output.
Repeated Wi-Fi driver crashes or link resets on hosts using the r8723bs module in proximity to unknown wireless transmitters.
Anomalous 802.11 management frames containing IEs whose declared length exceeds the frame body, captured via monitor-mode traces.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test builds to catch out-of-bounds reads inside the staging wireless driver during fuzzing.
Monitor kernel logs for stack traces that include rtw_get_wps_ie, rtw_check_beacon_data, or related rtl8723bs symbols.
Correlate wireless driver faults with nearby RF activity using intrusion detection sensors capable of parsing 802.11 management frames.

Monitoring Recommendations

Forward kernel logs from Linux endpoints to a central log store and alert on driver crash signatures tied to rtl8723bs.
Inventory hosts loading the r8723bs kernel module so patch status can be tracked against the fixed kernel version.
Track upstream Linux stable release notes for the referenced commits to confirm which distribution kernels have merged the fix.

How to Mitigate CVE-2026-68190

Immediate Actions Required

Update to a Linux kernel that includes the fix from commits 0e95ff7, 23c31f1, 630fdca, 875479f, and b9d9a4c.
Identify systems using RTL8723BS adapters, common on low-cost single-board computers and embedded devices, and prioritize them for patching.
If patching is delayed, unload the r8723bs module on systems that do not require wireless connectivity.

Patch Information

The fix adds bounds checks at the top of the parsing loop in rtw_get_wps_ie(). The loop now breaks early if fewer than 2 bytes remain for the IE header or if the declared payload extends past the end of the buffer. It also requires at least 4 bytes of payload before comparing against the WPS OUI. Apply the vendor kernel update that incorporates these stable commits.

Workarounds

Blacklist the r8723bs kernel module on hosts that do not need this adapter to eliminate the exposed code path.
Replace RTL8723BS adapters with hardware backed by a mainline, non-staging driver on production or high-value systems.
Restrict physical and RF proximity by placing affected devices in controlled wireless environments where untrusted transmitters cannot reach them.

bash

# Prevent the vulnerable driver from loading
echo "blacklist r8723bs" | sudo tee /etc/modprobe.d/blacklist-r8723bs.conf
sudo rmmod r8723bs 2>/dev/null || true
sudo update-initramfs -u