CVE-2026-74650: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74650 Overview

CVE-2026-74650 is an out-of-bounds read vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw lives in WMM_param_handler(), which copies a fixed-size Wi-Fi Multimedia (WMM) parameter element from a received information element (IE) without validating the element length. A malformed vendor-specific IE carrying the WMM Organizationally Unique Identifier (OUI) but with a length between 6 and 23 bytes causes memcmp() and memcpy() to read past the end of the buffer.

Critical Impact
The handler is reachable from a remote peer through a crafted association response frame, allowing an attacker in radio range of a vulnerable Realtek RTL8723BS client to trigger kernel out-of-bounds reads.

Affected Products

Linux kernel drivers/staging/rtl8723bs Realtek Wi-Fi driver
Linux kernel versions prior to the fix commits published on git.kernel.org
Distributions shipping the rtl8723bs staging driver for Realtek RTL8723BS SDIO Wi-Fi adapters

Discovery Timeline

2026-08-22 - CVE-2026-74650 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74650

Vulnerability Analysis

The WMM_param_handler() function in the rtl8723bs staging driver processes WMM parameter IEs from 802.11 management frames. It reads sizeof(struct WMM_para_element) (18 bytes) starting at pIE->data + 6, requiring pIE->length to be at least 24 bytes (WLAN_WMM_LEN). The handler never validates this length before dereferencing the buffer.

Two of its three callers reach the handler after matching only the WMM OUI. OnAssocRsp() in rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a 4-byte OUI. Neither caller checks the IE length. A vendor-specific IE containing the WMM OUI but with a length between 6 and 23 passes the OUI test and drives the subsequent memcmp() and memcpy() past the element boundary.

Root Cause

The root cause is missing bounds validation on attacker-controlled pIE->length before fixed-size structure access [CWE-125: Out-of-bounds Read]. The sibling handlers HT_caps_handler(), HT_info_handler(), and ERP_IE_handler() in the same parsing loop correctly bound their accesses by pIE->length, but WMM_param_handler() inherited an assumption that its single guarded caller in rtw_wlan_util.c was the only path.

Attack Vector

OnAssocRsp() parses association response frames received from an access point, so this condition is reachable from a remote peer over the air. An attacker operating a rogue AP or injecting frames within radio range of a station using the rtl8723bs driver can send an association response carrying a malformed WMM vendor IE. The resulting kernel out-of-bounds read can leak adjacent memory contents or trigger a fault, depending on allocator layout and hardening options such as KASAN and CONFIG_SLAB_FREELIST_HARDENED.

The fix moves the equivalent pIE->length == WLAN_WMM_LEN check into WMM_param_handler() itself so every caller is covered. See the Linux Kernel Commit 1158b99 and companion stable backports for the applied patches.

Detection Methods for CVE-2026-74650

Indicators of Compromise

Kernel logs containing KASAN: slab-out-of-bounds or BUG: reports referencing WMM_param_handler, OnAssocRsp, or join_cmd_hdl in the rtl8723bs module.
Unexpected disconnects, association failures, or system panics on hosts using Realtek RTL8723BS SDIO Wi-Fi adapters when connecting to unfamiliar access points.
Wireless captures showing association responses with vendor-specific IEs carrying OUI 00:50:F2:02 (WMM) and a total IE length below 24 bytes.

Detection Strategies

Enable KASAN in test kernels and replay captured association responses to surface the out-of-bounds read deterministically.
Monitor dmesg and journald for oops or KASAN traces referencing symbols in drivers/staging/rtl8723bs/core/rtw_wlan_util.c and rtw_mlme_ext.c.
Inventory endpoints for the r8723bs kernel module (lsmod | grep r8723bs) and correlate against the running kernel version to identify hosts still exposed.

Monitoring Recommendations

Forward kernel logs from Linux endpoints and IoT devices into a centralized log platform and alert on kernel crash signatures involving Wi-Fi driver symbols.
Track wireless client behavior for repeated association failures against untrusted SSIDs, which may indicate probing of this bug.
Maintain an asset inventory of devices carrying Realtek RTL8723BS chipsets, common in embedded boards and single-board computers.

How to Mitigate CVE-2026-74650

Immediate Actions Required

Apply the upstream stable kernel updates that include the WMM_param_handler() length check, using your distribution's patched packages.
Restrict vulnerable hosts to trusted, authenticated Wi-Fi networks such as WPA2/WPA3-Enterprise until patches are deployed.
Where the RTL8723BS adapter is not required, blacklist the r8723bs module to eliminate the attack surface entirely.

Patch Information

Fixes are available in the mainline and stable trees through the following commits: Linux Kernel Commit 1158b99, Linux Kernel Commit 2bee6f7, Linux Kernel Commit 5df2fd0, Linux Kernel Commit 6cdca4c, Linux Kernel Commit ae21407, Linux Kernel Commit ce23997, Linux Kernel Commit e429c6d, and Linux Kernel Commit e5b7610. Rebuild custom kernels against a stable branch that incorporates one of these commits.

Workarounds

Unload and blacklist the driver: sudo modprobe -r r8723bs and add blacklist r8723bs to /etc/modprobe.d/blacklist-rtl8723bs.conf.
Replace the RTL8723BS SDIO adapter with a USB or PCIe Wi-Fi device backed by a maintained, non-staging driver.
Disable auto-connect to open networks and enforce a trusted SSID allowlist on affected endpoints.

bash

# Disable the vulnerable rtl8723bs driver until patches are applied
sudo modprobe -r r8723bs
echo "blacklist r8723bs" | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo update-initramfs -u