UBUNTU-CVE-2026-90017: High severity ubuntu/linux-azure vulnerability

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse() rtwactionframeparse() takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeof(struct ieee80211hdr3addr); ... c = framebody[0]; ... a = framebody[1]; framebody already points 24 bytes (sizeof(struct ieee80211hdr3addr)) into frame, so reading framebody[0] and framebody[1] requires framelen >= 26. A management action frame shorter than that (e.g. exactly 24 bytes, the minimum a malicious peer can send) causes a 1-2 byte out-of-bounds read. This is reachable from rtwcfg80211monitorifxmitentry() and cfg80211rtwmgmttx() in ioctlcfg80211.c, both of which pass attacker/user-influenced frame buffers and lengths straight through. Add the missing length check before framebody is dereferenced.