CVE-2026-74649
Received Received - Intake

Buffer Overflow in Linux Kernel RTL8723BS Driver

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory. The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74649
EUVD
EUVD-2026-64586

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel rtl8723bs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a missing length check in the WEP shared-key authentication handler for the rtl8723bs driver. The driver fails to validate the length of a challenge-text element, which should be exactly 128 bytes. Instead, it accepts values up to 255 bytes, leading to potential buffer overflow or underfill when copying data into a fixed-size 128-byte buffer. This flaw is exploitable over the air during shared-key authentication before association.

Detection Guidance

This vulnerability is specific to the Linux kernel's staging driver for RTL8723BS WiFi chips. Detection requires checking if your system uses this driver and kernel version. Inspect loaded kernel modules with 'lsmod | grep rtl8723bs' and check kernel version with 'uname -a'. If present, monitor for unusual authentication attempts or crashes during WiFi connection.

Impact Analysis

An attacker within wireless range could exploit this flaw to cause a buffer overflow or underfill in the kernel memory. This may lead to crashes, arbitrary code execution, or information disclosure. Since the vulnerability is reachable before association, it could allow unauthorized access or denial of service on affected systems using the rtl8723bs driver.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-74649. If using a custom or older kernel, disable the rtl8723bs driver module with 'sudo rmmod rtl8723bs' and prevent loading at boot by blacklisting it in /etc/modprobe.d/. Avoid connecting to untrusted WiFi networks until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart