CVE-2026-74649: Linux Kernel RTL8723BS Buffer Overflow

CVE-2026-74649 Overview

CVE-2026-74649 is a buffer overflow vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in the WEP shared-key authentication handler OnAuthClient(), which copies an attacker-controlled challenge-text length into a fixed 128-byte chg_txt buffer without validation. A malicious access point (AP) can send a malformed WLAN_EID_CHALLENGE element to trigger an out-of-bounds write of up to 127 bytes or force the driver to echo stale buffer memory. Exploitation occurs over the air, before association, during shared-key authentication.

Critical Impact
A rogue AP within radio range can overflow kernel memory on any client using the rtl8723bs driver, enabling denial of service or potential kernel memory corruption without user interaction.

Affected Products

Linux kernel staging/rtl8723bs driver (Realtek RTL8723BS SDIO Wi-Fi)
Multiple upstream stable branches referenced by patches 2c56ef658, 39ae10330, 4ba402fd47, 4d018e7d7d, 6235b5156b, 87c2f073d2, and a28a4b0592
Devices commonly shipping this chipset include low-power ARM single-board computers and embedded Linux platforms

Discovery Timeline

2026-08-22 - CVE-2026-74649 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74649

Vulnerability Analysis

The vulnerability sits in the client-side WEP shared-key authentication flow of the rtl8723bs driver. During shared-key authentication, the AP sends a challenge-text information element that the client must encrypt and echo back. The driver parses this element with rtw_get_ie(), which returns the raw length byte from the frame — a value up to 255. That length is passed directly to memcpy() into pmlmeinfo->chg_txt, a fixed 128-byte buffer.

Because no bounds check is performed, an attacker-controlled AP can specify a length larger than 128, producing a kernel heap or stack out-of-bounds write of up to 127 bytes. Alternatively, a shorter length leaves the tail of chg_txt uninitialized, and the driver later echoes stale memory back over the air, leaking kernel data.

Root Cause

The root cause is missing input validation on the length field of the WLAN_EID_CHALLENGE element. The 802.11 specification defines the challenge text as exactly 128 octets, exposed as the WLAN_AUTH_CHALLENGE_LEN constant. The driver failed to enforce that constraint before the memcpy(). The upstream fix requires the element length to equal WLAN_AUTH_CHALLENGE_LEN before use.

Attack Vector

Exploitation requires the attacker to operate a rogue AP within radio range of a vulnerable client. The victim must initiate WEP shared-key authentication against that AP, which can be induced through evil-twin or beacon-injection techniques. No credentials or prior association are required. The malicious frame is delivered during the second authentication frame containing the challenge element.

See the upstream fix commits under git.kernel.org for the exact patched code path.

Detection Methods for CVE-2026-74649

Indicators of Compromise

Kernel oops, KASAN slab-out-of-bounds reports, or panics referencing OnAuthClient or chg_txt in the rtl8723bs module
Unexpected disconnects or repeated shared-key authentication failures on devices using Realtek RTL8723BS Wi-Fi hardware
Presence of nearby APs advertising WEP shared-key authentication with abnormal challenge-text element lengths

Detection Strategies

Monitor kernel ring buffer (dmesg) and journald for crashes originating in the r8723bs or rtl8723bs staging driver
Deploy wireless intrusion detection sensors that flag 802.11 authentication frames carrying WLAN_EID_CHALLENGE elements with length values other than 128
Inventory endpoints for the loaded r8723bs kernel module and correlate against unpatched kernel versions

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on module-tagged fault signatures
Track wireless client authentication anomalies, particularly repeated shared-key attempts against unknown SSIDs
Audit embedded and IoT fleets for continued use of WEP, which should already be retired in favor of WPA2/WPA3

How to Mitigate CVE-2026-74649

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry and rebuild or update affected kernels
Disable WEP shared-key authentication on all managed networks and clients, forcing WPA2 or WPA3
Where patching is not immediately possible, unload the r8723bs module on systems that do not require the Realtek RTL8723BS radio

Patch Information

The fix enforces that the WLAN_EID_CHALLENGE element length equals WLAN_AUTH_CHALLENGE_LEN (128) before invoking memcpy() into chg_txt. Distributions should pull one of the following commits into the appropriate stable branch: 2c56ef658, 39ae10330, 4ba402fd47, 4d018e7d7d, 6235b5156b, 87c2f073d2, and a28a4b0592.

Workarounds

Blacklist the r8723bs module on systems that do not depend on this chipset
Configure wpa_supplicant to reject WEP networks entirely, eliminating the shared-key authentication code path
Replace legacy RTL8723BS-based hardware with modern Wi-Fi adapters supported by mainline drivers

bash

# Configuration example
# Blacklist the vulnerable staging driver until the kernel is patched
echo 'blacklist r8723bs' | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo rmmod r8723bs 2>/dev/null || true
sudo update-initramfs -u

# Ensure wpa_supplicant refuses WEP networks
# Add to /etc/wpa_supplicant/wpa_supplicant.conf:
#   network={
#       key_mgmt=WPA-PSK WPA-EAP SAE
#   }