CVE-2026-46305: staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: osdep: avoid NULL pointer dereference in rtwcbufalloc
The return value of kzallocflex() is used without ensuring that the allocation succeeded, and the pointer is dereferenced unconditionally.
Guard the access to the allocated structure to avoid a potential NULL pointer dereference if the allocation fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If applicable in your environment, ensure the code path that calls rtw_cbuf_alloc only proceeds after verifying kzalloc_flex() succeeded to prevent NULL pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46305?
CVE-2026-46305 has a risk severity score of 15, indicating a critical vulnerability.
What is CVE-2026-46305 about?
CVE-2026-46305 addresses a NULL pointer dereference vulnerability in the Linux kernel's rtl8723bs driver.
How do I fix CVE-2026-46305?
To fix CVE-2026-46305, ensure that you apply the latest patches and updates to the Linux kernel that address this vulnerability.
Which software is affected by CVE-2026-46305?
CVE-2026-46305 affects the Linux kernel specifically related to the rtl8723bs driver.
What causes the vulnerability in CVE-2026-46305?
The vulnerability in CVE-2026-46305 is caused by a failure to check the return value of kzalloc_flex(), leading to a potential NULL pointer dereference.