CVE-2026-90018: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-90018 Overview

CVE-2026-90018 is a stack buffer overflow and out-of-bounds read in the Linux kernel rtl8723bs staging Wi-Fi driver. The flaw resides in rtw_get_wps_attr(), which parses Wi-Fi Protected Setup (WPS) attributes from wireless management frames. The function validates the fixed 4-byte attribute header but never checks the attacker-controlled attr_data_len field against the remaining bytes in the information element (IE) before using it as a memcpy() length.

A crafted WPS IE embedded in a beacon or probe response processed during scanning can smash the stack of the parsing thread, enabling kernel memory corruption from an adjacent wireless attacker.

Critical Impact
An unauthenticated attacker within wireless range can trigger heap out-of-bounds reads and stack buffer overflows in the kernel by broadcasting a malformed WPS information element, leading to denial of service or potential kernel code execution.

Affected Products

Linux kernel staging/rtl8723bs driver (Realtek RTL8723BS SDIO Wi-Fi)
Systems using the RTL8723BS chipset with the in-tree staging driver enabled
Multiple stable kernel branches receiving backported fixes across seven commits

Discovery Timeline

2026-09-16 - CVE-2026-90018 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90018

Vulnerability Analysis

The rtw_get_wps_attr() function iterates over WPS attributes contained in a WPS IE extracted from an 802.11 management frame. For each attribute, the parser confirms the 4-byte header (2-byte ID plus 2-byte length) fits within the IE bounds. It then reads attr_data_len from the wire using get_unaligned_be16() and computes attr_len = attr_data_len + 4.

The parser never verifies that attr_len remains within the IE. It then passes the attacker-controlled length directly to memcpy(buf_attr, attr_ptr, attr_len). Because attr_data_len is a 16-bit field, attr_len can reach 65,539 bytes.

Several call sites pass a single-byte stack variable as buf_attr. For example, callers in drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c and drivers/staging/rtl8723bs/core/rtw_mlme_ext.c pass a u8 sr or u8 selected_registrar when requesting WPS_ATTR_SELECTED_REGISTRAR. The memcpy overwrites the parsing thread's stack.

Root Cause

The root cause is missing bounds validation on variable-length attribute data. A prior fix (commit 1463ca3ec6601) added a header-length check but did not extend the validation to cover the trailing data described by attr_data_len. rtw_get_wps_attr_content() performs no independent length check and trusts the value returned by rtw_get_wps_attr(), so both callers inherit the flaw. The issue is classified as an out-of-bounds read [CWE-125] combined with a stack-based buffer overflow [CWE-121].

Attack Vector

Exploitation requires wireless proximity to a target using the rtl8723bs driver. An attacker broadcasts a beacon or responds to a probe request with a management frame containing a malformed WPS IE. When the victim scans for networks, the driver parses the frame and invokes the vulnerable function. No authentication or user interaction is required.

See the upstream fix commit for the bounds check added before attr_len is used as a memcpy() length.

Detection Methods for CVE-2026-90018

Indicators of Compromise

Kernel oops, stack protector panics, or BUG: messages referencing rtw_get_wps_attr or rtw_get_wps_attr_content in dmesg
Unexpected reboots or crashes of hosts using the r8723bs module while Wi-Fi scanning is active
Presence of nearby SSIDs broadcasting oversized or malformed WPS information elements in packet captures

Detection Strategies

Monitor kernel ring buffer logs for KASAN reports or stack canary violations tied to the r8723bs module.
Capture 802.11 management frames in monitored environments and flag WPS IEs where an attribute's declared length exceeds the enclosing IE length.
Track loaded kernel modules across the fleet to identify hosts running the vulnerable staging driver.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on crash signatures naming rtl8723bs symbols.
Deploy wireless intrusion detection sensors in sensitive areas to detect anomalous beacon and probe response frames.
Inventory endpoints with Realtek RTL8723BS SDIO Wi-Fi adapters, which are common in low-cost SBCs, tablets, and legacy IoT devices.

How to Mitigate CVE-2026-90018

Immediate Actions Required

Update to a patched Linux kernel that includes the bounds check added in the fix commits referenced by NVD.
On systems that do not require the affected hardware, blacklist the r8723bs module to remove the attack surface entirely.
Restrict Wi-Fi scanning on unattended devices and disable automatic connection to unknown networks where feasible.

Patch Information

The fix adds a bounds check ensuring attr_ptr + attr_len <= wps_ie + wps_ielen before memcpy() is invoked or the attribute is accepted as a match. Patched commits are available across multiple stable branches:

Workarounds

Unload and blacklist the r8723bs kernel module on hosts that do not need Realtek RTL8723BS Wi-Fi.
Disable Wi-Fi radios on affected devices operating in untrusted RF environments until patches are applied.
Replace RTL8723BS adapters with Wi-Fi hardware backed by mainline (non-staging) drivers where practical.

bash

# Prevent the vulnerable staging driver from loading
echo "blacklist r8723bs" | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo rmmod r8723bs 2>/dev/null
sudo update-initramfs -u