CVE-2026-90017: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in rtwactionframeparse()

rtwactionframeparse() takes a framelen parameter but never actually checks it before indexing into the frame body:

const u8 framebody = frame + sizeof(struct ieee80211hdr3addr); ... c = framebody[0]; ... a = framebody[1];

framebody already points 24 bytes (sizeof(struct ieee80211hdr3addr)) into frame, so reading framebody[0] and framebody[1] requires framelen >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtwcfg80211monitorifxmitentry() and cfg80211rtwmgmttx() in ioctlcfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before framebody is dereferenced.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Implement/enable the missing length check in rtw_action_frame_parse() to ensure frame_len >= 26 before reading frame_body[0] and frame_body[1], preventing 1–2 byte out-of-bounds reads from attacker-controlled frame buffers.

    Linux kernel (cfg80211/rtw cfg80211 integration) Missing length check before frame_body dereference (frame_body[0]/frame_body[1]) = enforce frame_len >= 26

Event History

Sep 16, 2026
CVE Published
via MITRE·10:33 AM
Data Sourced
via MITRE·10:33 AM
Description

Frequently Asked Questions

1

What inputs can trigger the out-of-bounds read?

A management action frame shorter than 26 bytes can trigger it, including a 24-byte frame. The affected parser reads two bytes beginning 24 bytes into the supplied frame without first confirming that those bytes are present.

2

Does exploitation require a remote wireless peer?

The vulnerable paths receive attacker- or user-influenced frame buffers and lengths through rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx(). The provided information specifically identifies a malicious peer as able to send a minimum-length 24-byte frame.

3

What should be checked to determine whether the fix is present?

Verify that rtw_action_frame_parse() validates the frame length before dereferencing frame_body[0] or frame_body[1]. The required validation must ensure the input frame is at least 26 bytes long.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203