CVE-2026-90017: Linux Kernel RTL8723BS Buffer Overflow

CVE-2026-90017 Overview

CVE-2026-90017 is an out-of-bounds read vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw lives in rtw_action_frame_parse(), which accepts a frame_len parameter but never validates it before dereferencing the action frame body. An adjacent wireless attacker can transmit a malformed 802.11 management action frame of exactly 24 bytes to trigger a 1-2 byte read past the buffer boundary. The bug is reachable through rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which forward attacker-influenced buffers directly to the parser.

Critical Impact
A malicious peer within wireless range can send a short management action frame to cause an out-of-bounds kernel memory read, potentially leading to information disclosure or system instability on Linux hosts using the rtl8723bs driver.

Affected Products

Linux kernel staging driver rtl8723bs (Realtek 8723BS Wi-Fi)
Linux distributions shipping the affected staging driver prior to the fix commits
Embedded and IoT devices using rtl8723bs-based Wi-Fi modules

Discovery Timeline

2026-09-16 - CVE-2026-90017 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90017

Vulnerability Analysis

The vulnerability resides in the rtw_action_frame_parse() function within the rtl8723bs staging driver. The function computes frame_body = frame + sizeof(struct ieee80211_hdr_3addr), which advances the pointer 24 bytes into the frame. It then reads frame_body[0] (the action category) and frame_body[1] (the action code) without confirming that frame_len is at least 26 bytes. Any 802.11 management action frame shorter than 26 bytes causes a 1-2 byte out-of-bounds read of adjacent kernel memory. This read can leak sensitive kernel data into logic that dispatches on category and action values, and it may destabilize handling routines depending on the returned bytes.

Root Cause

The root cause is missing input validation [Out-of-Bounds Read]. rtw_action_frame_parse() trusts the caller-supplied frame_len but never enforces the minimum size required to safely index the action frame body. Because callers such as rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx() pass through user-space or over-the-air frame buffers, the length check must be performed inside the parser itself. The upstream fix adds an explicit length guard before any dereference of frame_body.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be within Wi-Fi range of a Linux host running the vulnerable rtl8723bs driver. No authentication or user interaction is required. The attacker crafts an 802.11 management action frame with an ieee80211_hdr_3addr header and no action body, resulting in a total frame length of exactly 24 bytes. When the driver processes the frame, frame_body[0] and frame_body[1] read memory outside the received packet buffer. Repeated transmission of malformed frames can be used to probe kernel memory behavior or induce denial of service.

No verified public exploit code is available. See the upstream kernel commits referenced below for the corrective patches.

Detection Methods for CVE-2026-90017

Indicators of Compromise

Unexpected kernel warnings, KASAN reports, or oopses referencing rtw_action_frame_parse or the rtl8723bs module in dmesg and /var/log/kern.log.
Bursts of malformed or truncated 802.11 management action frames observed on monitored wireless interfaces.
Unexplained Wi-Fi driver crashes or interface resets on systems using Realtek 8723BS chipsets.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and pre-production kernels to catch the 1-2 byte OOB read at runtime.
Deploy wireless intrusion detection sensors that flag 802.11 action frames whose total length is less than 26 bytes.
Correlate kernel driver crash telemetry with wireless capture data to identify targeted frame injection.

Monitoring Recommendations

Ship kernel logs to a centralized data lake and alert on stack traces containing rtl8723bs or rtw_action_frame_parse.
Monitor endpoint uptime and Wi-Fi interface stability for systems known to load the rtl8723bs driver.
Track running kernel versions across the fleet and alert when hosts using this driver run kernels prior to the patched commits.

How to Mitigate CVE-2026-90017

Immediate Actions Required

Update the Linux kernel to a stable release that includes one of the referenced fix commits for rtw_action_frame_parse().
Inventory hosts loading the rtl8723bs module using lsmod | grep rtl8723bs and prioritize patching those systems.
If patching cannot be immediate, unload the driver with modprobe -r r8723bs on systems that do not require the interface.

Patch Information

The upstream fix adds a length check ensuring frame_len is large enough before dereferencing the action frame body. Patched commits are available in the stable trees, including commit 0b7f64c7bb96, commit 136f9a3ab87d, commit 1410bce22351, commit 15081ff835b2, commit 310aaa8058d1, commit a54fd1a44862, commit b041e3f35e0d, and commit ff917923f4fb.

Workarounds

Blacklist the r8723bs module on systems that do not need Realtek 8723BS Wi-Fi functionality.
Disable monitor mode and management-frame transmission paths on interfaces backed by this driver where possible.
Restrict physical proximity to trusted wireless environments for critical hosts that cannot be patched immediately.

bash

# Blacklist the vulnerable staging driver until the kernel is patched
echo 'blacklist r8723bs' | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo modprobe -r r8723bs
sudo update-initramfs -u