CVE-2026-68190
Received Received - Intake

Buffer Overflow in Linux Kernel RTL8723BS Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - in_ie[cnt + 1] is read without checking cnt + 1 < in_len - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check - in_ie[cnt + 1] is used as length without verifying payload fits Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer. Also require at least 4 bytes of payload before comparing the WPS OUI.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68190
EUVD
EUVD-2026-55291

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds (OOB) read flaw in the Linux kernel's staging driver for Realtek RTL8723BS wireless devices. The function rtw_get_wps_ie() processes network frame data without proper validation, allowing it to read memory outside the intended buffer. Specifically, it fails to check if the IE header and payload fit within the remaining buffer before accessing them, leading to potential memory corruption or information leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's staging driver for RTL8723BS WiFi chips. Detection requires checking if your system runs a vulnerable kernel version with the affected driver. Inspect kernel logs for crashes or memory corruption during WiFi operations. Use commands like 'dmesg | grep rtw' or 'lsmod | grep r8723bs' to check for the driver's presence.

Impact Analysis

If exploited, this vulnerability could allow an attacker within wireless network range to trigger memory corruption or read sensitive kernel memory. This might lead to system crashes, privilege escalation, or unauthorized access to data. Users of affected Linux systems with RTL8723BS devices should update their kernel to a patched version.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-68190. If you cannot update immediately, disable the vulnerable driver module 'rtl8723bs' using 'modprobe -r r8723bs' and prevent it from loading at boot with 'echo 'blacklist r8723bs' >> /etc/modprobe.d/blacklist.conf'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart