CVE-2026-90017: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in rtwactionframeparse()
rtwactionframeparse() takes a framelen parameter but never actually checks it before indexing into the frame body:
const u8 framebody = frame + sizeof(struct ieee80211hdr3addr); ... c = framebody[0]; ... a = framebody[1];
framebody already points 24 bytes (sizeof(struct ieee80211hdr3addr)) into frame, so reading framebody[0] and framebody[1] requires framelen >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read.
This is reachable from rtwcfg80211monitorifxmitentry() and cfg80211rtwmgmttx() in ioctlcfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through.
Add the missing length check before framebody is dereferenced.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement/enable the missing length check in rtw_action_frame_parse() to ensure frame_len >= 26 before reading frame_body[0] and frame_body[1], preventing 1–2 byte out-of-bounds reads from attacker-controlled frame buffers.
Linux kernel (cfg80211/rtw cfg80211 integration) Missing length check before frame_body dereference (frame_body[0]/frame_body[1]) = enforce frame_len >= 26
Event History
Frequently Asked Questions
What inputs can trigger the out-of-bounds read?
A management action frame shorter than 26 bytes can trigger it, including a 24-byte frame. The affected parser reads two bytes beginning 24 bytes into the supplied frame without first confirming that those bytes are present.
Does exploitation require a remote wireless peer?
The vulnerable paths receive attacker- or user-influenced frame buffers and lengths through rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx(). The provided information specifically identifies a malicious peer as able to send a minimum-length 24-byte frame.
What should be checked to determine whether the fix is present?
Verify that rtw_action_frame_parse() validates the frame length before dereferencing frame_body[0] or frame_body[1]. The required validation must ensure the input frame is at least 26 bytes long.