CVE-2026-74651: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74651 Overview

CVE-2026-74651 is an out-of-bounds read vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in rtw_get_wpa_ie(), which parses vendor-specific information elements (IEs) from 802.11 management frames and user-supplied configuration data. The function reads a 4-byte OUI+type at offset pbuf + 2 and a 2-byte version word at offset pbuf + 6 without verifying that the IE body is at least 6 bytes long. A crafted short IE (length byte 0–5) placed at the end of the buffer causes the driver to read past the allocation boundary.

Critical Impact
An adjacent-network attacker can trigger an out-of-bounds read in kernel memory by transmitting malformed 802.11 management frames to a system using the rtl8723bs driver, leading to information disclosure or a kernel crash.

Affected Products

Linux kernel drivers/staging/rtl8723bs (Realtek RTL8723BS Wi-Fi driver)
Systems using the rtl8723bs staging driver across multiple stable branches
Distributions shipping affected staging kernel modules

Discovery Timeline

2026-08-22 - CVE-2026-74651 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74651

Vulnerability Analysis

The rtw_get_wpa_ie() helper in drivers/staging/rtl8723bs/core/rtw_ieee.c searches for a vendor-specific information element with EID 221 using rtw_get_ie(). Once located, it performs a memcmp() on the 4-byte OUI+type at pbuf + 2 and reads a 2-byte version field at pbuf + 6. These accesses require the IE body to span at least 6 bytes.

However, rtw_get_ie() only guarantees the element fits inside the outer buffer. It does not enforce a minimum body length. When a vendor-specific IE with a length byte of 0 through 5 is placed at the tail of the buffer, the fixed-offset reads run past the IE and past the end of the allocation.

The parsed buffers originate from received 802.11 management frames and from IE blobs passed to rtw_cfg80211_set_wpa_ie(). The latter is copied with kmemdup() sized to the input length, so the over-read escapes the slab object entirely. Sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_ie() already perform this length check; rtw_get_wpa_ie() was not aligned with them.

Root Cause

The root cause is missing input validation on the IE length field before dereferencing bytes at fixed offsets. The function trusts that any vendor-specific IE returned by rtw_get_ie() is long enough to contain both the OUI+type triplet and the version word, without asserting a minimum length of 6 bytes.

Attack Vector

An attacker within Wi-Fi range of a target using the rtl8723bs driver can broadcast or transmit management frames containing a truncated vendor-specific IE (EID 221) with a length byte between 0 and 5, positioned at the end of the frame's IE list. Local userspace with permission to configure Wi-Fi parameters can also trigger the read path through rtw_cfg80211_set_wpa_ie(). The out-of-bounds read may leak adjacent kernel memory into subsequent parsing logic or cause a fault in kernel context.

The patch adds a length check requiring the IE body to be at least 6 bytes before the OUI comparison and version read. See the upstream fixes in Kernel Git Commit 01ab275 and Kernel Git Commit e167a38.

Detection Methods for CVE-2026-74651

Indicators of Compromise

Kernel oops or KASAN: slab-out-of-bounds reports referencing rtw_get_wpa_ie in dmesg or journalctl -k output
Unexpected reboots or Wi-Fi driver crashes on hosts loading the rtl8723bs module
Malformed 802.11 beacon, probe response, or association frames containing EID 221 vendor IEs shorter than 6 bytes

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to catch out-of-bounds reads inside rtw_get_wpa_ie()
Deploy wireless intrusion detection sensors that flag 802.11 management frames with truncated vendor-specific IEs
Audit endpoints for the presence of the rtl8723bs staging module and correlate with kernel version metadata

Monitoring Recommendations

Forward kernel logs to a centralized data lake and alert on driver-specific panic traces and slab access violations
Track Wi-Fi driver load events and module versions across the fleet to identify unpatched hosts
Monitor for repeated Wi-Fi disconnection or driver reset events on devices using Realtek RTL8723BS hardware

How to Mitigate CVE-2026-74651

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable commits listed below and rebuild or update affected kernel packages
Inventory endpoints running the rtl8723bs staging driver, prioritizing embedded and IoT devices that seldom receive updates
If patching is not immediately possible, unload the driver with modprobe -r rtl8723bs and blacklist the module

Patch Information

The fix adds a minimum length check in rtw_get_wpa_ie() that requires the vendor-specific IE body to be at least 6 bytes before reading the OUI and version fields. Backports are available across multiple stable branches through Kernel Git Commit 01ab275, Kernel Git Commit 0d19f06, Kernel Git Commit 1c3e23e, Kernel Git Commit 42c5a0d, Kernel Git Commit 4fc459c, Kernel Git Commit b45be82, Kernel Git Commit c9068f8, and Kernel Git Commit e167a38.

Workarounds

Blacklist the rtl8723bs module until a patched kernel is deployed
Replace affected Realtek RTL8723BS hardware with adapters using non-staging, actively maintained drivers where feasible
Restrict physical and radio-frequency access to systems that cannot be patched, reducing adjacent-network exposure

bash

# Blacklist the vulnerable staging driver until a patched kernel is available
echo "blacklist rtl8723bs" | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo modprobe -r rtl8723bs
sudo update-initramfs -u