CVE-2026-74648: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74648 Overview

CVE-2026-74648 is an out-of-bounds read vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in rtw_cfg80211_monitor_if_xmit_entry(), which strips the radiotap header from a socket buffer and then accesses the 802.11 frame control field without verifying that a base 802.11 header remains. The data path further advances past the calculated 802.11, QoS, and SNAP header span before confirming the skb contains those bytes. A truncated frame can trigger out-of-bounds reads or leave insufficient data for subsequent Ethernet address writes.

Critical Impact
A local attacker with the ability to inject frames through a monitor-mode interface backed by the rtl8723bs driver can trigger memory corruption or information disclosure in kernel context.

Affected Products

Linux kernel drivers/staging/rtl8723bs wireless driver
Systems using Realtek RTL8723BS SDIO Wi-Fi hardware in monitor mode
Multiple stable kernel branches receiving backport fixes

Discovery Timeline

2026-08-22 - CVE-2026-74648 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74648

Vulnerability Analysis

The rtl8723bs staging driver exposes a cfg80211 monitor interface used to transmit raw 802.11 frames prefixed with a radiotap header. In rtw_cfg80211_monitor_if_xmit_entry(), the driver calls skb_pull() to remove the radiotap header and then dereferences the frame control field of the assumed 802.11 header. When a userspace caller submits a frame smaller than the required base 802.11 header, the dereference reads memory outside the intended packet buffer.

Downstream, the transmit path calculates a total header span covering the 802.11 header, an optional QoS control field, and the SNAP/LLC header. It advances the skb past this span before validating that the skb actually contains that many bytes. The subsequent code writes Ethernet source and destination addresses into locations that may sit past the end of the packet payload.

Root Cause

The root cause is missing length validation between skb_pull() operations and header field accesses in the monitor transmit path. The driver trusts the caller-supplied frame length instead of bounding each header parse against the remaining skb length.

Attack Vector

Exploitation requires local access with permission to send frames through a monitor-mode netdev backed by rtl8723bs. Typically this requires CAP_NET_ADMIN or an unprivileged user granted access to a monitor interface. A crafted short frame reaches the driver through the standard AF_PACKET or cfg80211 transmit path. The resulting out-of-bounds read can leak adjacent kernel memory, and the following writes to Ethernet address fields can corrupt kernel memory, enabling privilege escalation or denial of service.

No public proof-of-concept is referenced in the advisory. See the upstream fixes at Kernel Commit 6829665 and Kernel Commit f03398d for the exact validation logic added.

Detection Methods for CVE-2026-74648

Indicators of Compromise

Unexpected kernel oops, KASAN slab-out-of-bounds reports, or general protection faults referencing rtw_cfg80211_monitor_if_xmit_entry or rtl8723bs.
Unprivileged or service accounts creating monitor-mode interfaces on systems shipping Realtek RTL8723BS radios.
Anomalous use of AF_PACKET raw sockets sending short frames to wireless monitor interfaces.

Detection Strategies

Enable CONFIG_KASAN in test and staging kernels to surface out-of-bounds reads in the driver during fuzzing.
Audit systems for loaded r8723bs modules and correlate with process activity that opens raw sockets on mon* interfaces.
Use eBPF or auditd rules to log ioctl and sendmsg calls targeting monitor-mode wireless interfaces.

Monitoring Recommendations

Collect kernel logs (dmesg, journalctl -k) centrally and alert on driver panics or WARN traces referencing rtl8723bs.
Track loaded kernel modules across the fleet and flag unpatched kernels on devices using the Realtek RTL8723BS chipset.
Monitor process capability grants of CAP_NET_ADMIN to non-administrative accounts.

How to Mitigate CVE-2026-74648

Immediate Actions Required

Update to a stable Linux kernel release containing the upstream fixes referenced in the NVD advisory.
Unload the r8723bs module on systems that do not require Realtek RTL8723BS Wi-Fi functionality.
Restrict creation of monitor-mode interfaces to trusted administrators and remove CAP_NET_ADMIN from service accounts that do not require it.

Patch Information

The fix rejects frames that do not contain a full base 802.11 header and drops data frames that do not carry their complete calculated 802.11/QoS/SNAP header span. Backports are available in the following stable kernel commits: 6829665, 7b0f62d, 7edd3ad, 8b3e4ed, a3ac6d8, bd88f62, c5e5d78, and f03398d.

Workarounds

Blacklist the r8723bs module on systems where the Realtek RTL8723BS radio is unused.
Disable monitor-mode support at the network configuration layer to prevent creation of vulnerable interfaces.
Enforce least privilege so that only trusted users hold CAP_NET_ADMIN and can attach raw sockets to wireless interfaces.

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist r8723bs" | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo rmmod r8723bs 2>/dev/null || true
sudo update-initramfs -u