CVE-2026-90018: staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr()
rtwgetwpsattr() walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte attribute header (2-byte ID + 2-byte length) fits inside the IE:
if (attrptr + 4 > wpsie + wpsielen) break; u16 attrid = getunalignedbe16(attrptr); u16 attrdatalen = getunalignedbe16(attrptr + 2); u16 attrlen = attrdatalen + 4;
attrdatalen (and therefore attrlen) is read directly from the wire and is never checked against the remaining bytes in the IE before being used as the size of:
memcpy(bufattr, attrptr, attrlen);
Since attrlen is fully attacker controlled (0 to 65535+4), this is both a heap OOB read of wpsie, and, more seriously, a stack buffer overflow at several call sites where bufattr is a single-byte stack variable, e.g. rtwgetwpsattrcontent()'s callers passing WPSATTRSELECTEDREGISTRAR into a stack "u8 sr"/"u8 selectedregistrar" (drivers/staging/rtl8723bs/osdep/ioctlcfg80211.c, drivers/staging/rtl8723bs/core/rtwmlmeext.c). A crafted WPS IE in a beacon or probe response processed during scanning can therefore smash the stack of the parsing thread.
rtwgetwpsattrcontent() itself has no independent length check and simply trusts the attrlen it gets back from rtwgetwpsattr(), so fixing the bound here also fixes that caller.
The "attrptr + 4 > wpsie + wpsielen" header check above was added by commit 1463ca3ec6601 ("staging: rtl8723bs: fix OOB reads in rtwgetsecie(), rtwgetwapiie(), and rtwgetwpsattr()"), which bounded the fixed header but never extended the check to cover the variable-length attribute data that follows it. Add that missing check before attrlen is used as a memcpy() length or accepted as a match.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 1463ca3ec6601 - Configuration
Ensure the parsing code adds the header bounds check ("if (attr_ptr + 4 > wps_ie + wps_ielen)") and only then uses attacker-controlled attr_len (computed as attr_data_len + 4) as a memcpy() length in rtw_get_wps_attr() / rtw_get_wps_attr_content().
rtw_mlme_ext.c (staging: rtl8723bs) WPS IE attribute parsing attr_len bounds check for memcpy() = Set/keep guard: if (attr_ptr + 4 > wps_ie + wps_ielen) reject before using attr_len in memcpy
Event History
Frequently Asked Questions
What must an attacker provide to reach the unsafe copy?
The attacker must supply a WPS information element in a wireless management frame containing an attribute whose 4-byte header fits within the element but whose wire-controlled length exceeds the remaining attribute data.
Which code paths are identified as having stack-buffer-overflow exposure?
The affected call sites include callers of rtw_get_wps_attr_content() that request WPS_ATTR_SELECTED_REGISTRAR and pass a one-byte stack variable such as “sr” or “selected_registrar.” The cited locations are drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c and drivers/staging/rtl8723bs/core/rtw_mlme_ext.c.