CVE-2026-90016: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-90016 Overview

CVE-2026-90016 is an out-of-bounds read vulnerability in the Linux kernel staging driver for the Realtek rtl8723bs wireless chipset. The flaw resides in rtw_restruct_wmm_ie(), which parses Information Elements (IEs) supplied through association and scan data. When the function fails to find a Wi-Fi Multimedia (WMM) IE near the end of the input buffer, it advances the parsing index using an unchecked length byte. An attacker on the same wireless network can trigger a 1-byte read past the end of an attacker-influenced IE buffer.

Critical Impact
A crafted 802.11 frame from an adjacent network attacker can cause a kernel out-of-bounds read, potentially leading to information disclosure or kernel panic on systems using the rtl8723bs driver.

Affected Products

Linux kernel versions containing the staging/rtl8723bs driver prior to the fix
Systems running the Realtek RTL8723BS SDIO Wi-Fi chipset
Distributions shipping the vulnerable staging driver (see the referenced stable kernel commits for backport coverage)

Discovery Timeline

2026-09-16 - CVE-2026-90016 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90016

Vulnerability Analysis

The rtw_restruct_wmm_ie() function in the rtl8723bs staging driver walks an input IE buffer (in_ie) of length in_len looking for a WMM IE (vendor-specific IE with tag 0xDD). Commit a75281626fc8f previously added the i + 5 < in_len guard inside the match condition to prevent an out-of-bounds read when validating the WMM OUI bytes. That fix, however, was incomplete.

When the match check fails because i is within five bytes of the buffer end, control falls through to the advance statement i += (in_ie[i + 1] + 2). This statement reads in_ie[i + 1] without any bounds check. If i == in_len - 1, the read is one byte past the end of the buffer. Because in_ie is built from association and scan data received over the air, an adjacent attacker can influence its contents and length.

Root Cause

The root cause is missing bounds validation before pointer advancement in an IE parsing loop, classified as Out-of-Bounds Read. The prior patch hardened the match branch but did not guard the non-matching fallthrough path, leaving the same class of read reachable when the loop terminates near the buffer tail.

Attack Vector

Exploitation requires adjacent network access. An attacker within Wi-Fi range crafts association responses, beacons, or probe responses containing an IE stream sized so that the parser's index lands at in_len - 1 during a non-matching iteration. Processing the malformed IE buffer triggers the 1-byte over-read in kernel memory. The primary impact is availability (kernel oops or panic) with a lower likelihood of information disclosure through subsequent parser state.

No public proof-of-concept exploit is currently available. See the Linux Kernel Commit fd19b88 for the corrective patch.

Detection Methods for CVE-2026-90016

Indicators of Compromise

Unexpected kernel oops or panic messages referencing rtw_restruct_wmm_ie or the r8723bs module in dmesg or journalctl -k output.
KASAN (Kernel Address Sanitizer) reports flagging a slab-out-of-bounds or global-out-of-bounds read in the rtl8723bs staging driver.
Repeated Wi-Fi disconnects or driver resets on affected hardware in proximity to unknown access points.

Detection Strategies

Monitor kernel logs for stack traces originating in the rtl8723bs IE parsing path following association attempts.
Enable KASAN in test environments to surface out-of-bounds reads during exposure to untrusted wireless networks.
Correlate wireless scan events and association failures with kernel warnings from the driver module.

Monitoring Recommendations

Forward kernel logs from Linux endpoints and embedded devices to a centralized log platform for anomaly detection.
Alert on module crashes involving staging wireless drivers, particularly r8723bs, across fleets of IoT and single-board-computer devices.
Track kernel package versions across the fleet and flag hosts still running vulnerable builds of the staging driver.

How to Mitigate CVE-2026-90016

Immediate Actions Required

Apply the upstream fix from the referenced stable kernel commits and rebuild or update kernel packages on affected systems.
Unload the r8723bs module on hosts that do not require the RTL8723BS chipset until patches are applied.
Restrict the wireless environments in which vulnerable devices operate, favoring trusted, authenticated networks.

Patch Information

The fix adds an explicit bounds check before the fallthrough advance in rtw_restruct_wmm_ie(). It is available in the following stable commits: Linux Kernel Commit 28a289b, Linux Kernel Commit 4420cc7, and Linux Kernel Commit fd19b88. Consume the fix through distribution kernel updates as soon as they are published.

Workarounds

Blacklist the r8723bs kernel module on systems where the Realtek RTL8723BS chipset is not required.
Disable Wi-Fi on affected devices when operating in untrusted radio environments.
Replace RTL8723BS hardware with a supported non-staging wireless chipset where feasible for long-term risk reduction.

bash

# Blacklist the vulnerable staging module until patches are deployed
echo 'blacklist r8723bs' | sudo tee /etc/modprobe.d/blacklist-r8723bs.conf
sudo rmmod r8723bs 2>/dev/null || true
sudo update-initramfs -u