CVE-2026-31626: staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: initialize letmp64 in rtwBIPverify()
Initialize letmp64 to zero in rtwBIPverify() to prevent using uninitialized data.
Smatch warns that only 6 bytes are copied to this 8-byte (u64) variable, leaving the last two bytes uninitialized:
drivers/staging/rtl8723bs/core/rtwsecurity.c:1308 rtwBIPverify() warn: not copying enough bytes for '&letmp64' (8 vs 6 bytes)
Initializing the variable at the start of the function fixes this warning and ensures predictable behavior.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In drivers/staging/rtl8723bs/core/rtw_security.c, initialize the le_tmp64 variable to zero at the start of rtw_BIP_verify() before copying the 6-byte value into it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31626?
CVE-2026-31626 is classified as a medium severity vulnerability due to the potential for data corruption from using uninitialized variables.
How do I fix CVE-2026-31626?
To fix CVE-2026-31626, ensure the Linux kernel is updated to a version where le_tmp64 is properly initialized in rtw_BIP_verify().
Which Linux kernel versions are affected by CVE-2026-31626?
CVE-2026-31626 affects Linux kernel versions from 4.12 up to 6.6.136, as well as between 6.7 and 6.12.83, and also includes 6.13 to 6.18.24.
Is CVE-2026-31626 exploitable in production systems?
Yes, CVE-2026-31626 can be exploited in production systems, particularly those using the rtl8723bs staging driver.
What components are involved in CVE-2026-31626?
CVE-2026-31626 involves the rtl8723bs driver within the Linux kernel, specifically the rtw_BIP_verify() function.