CVE-2026-98160

Analyzed Analyzed - Analysis Complete

Memory Corruption in Linux Kernel RTL8723BS Driver

Publication date: 2026-09-25

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalData is allocated via vzalloc(), but incorrectly freed using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to release this vmalloc-backed buffer can lead to memory corruption. Use rtw_hal_data_deinit() to pair the free correctly and free HalData with vfree(). The bug was first flagged by an experimental static analysis tool we are developing for kernel memory-management bugs. Manual inspection confirms that the issue is still present in current mainline. An x86_64 allyesconfig build showed no new warnings. As we do not have suitable RTL8723BS SDIO hardware to test with, no runtime testing was able to be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-02

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98160

EUVD

EUVD-2026-87060

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.221 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.188 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.52 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.2.6 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.157 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.110 (exc)
linux	linux_kernel	From 4.12 (inc) to 5.10.270 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-763	The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where HalData memory allocated with vzalloc() is incorrectly freed using kfree() in the error path of rtw_sdio_if1_init(). This mismatch can cause memory corruption because kfree() is meant for kmalloc() memory, not vmalloc() memory.

Detection Guidance

This vulnerability involves incorrect memory handling in the Linux kernel's RTL8723BS SDIO driver. Detection requires checking for memory corruption symptoms or kernel oops related to the staging: rtl8723bs module. Use kernel logs with 'dmesg | grep rtl8723bs' or 'journalctl -k | grep rtl8723bs' to identify errors. No specific commands exist for direct detection as it requires runtime testing on vulnerable hardware.

Impact Analysis

This vulnerability could lead to system instability or crashes due to memory corruption. It may also create potential security risks if exploited to execute arbitrary code or gain elevated privileges.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves a memory management issue in the Linux kernel's staging driver for RTL8723BS SDIO devices, which could lead to memory corruption if exploited. Compliance impacts would only occur if this vulnerability were exploited to compromise system integrity or data confidentiality.

Mitigation Strategies

Apply a kernel update that includes the fix for staging: rtl8723bs. If updating is not possible, disable the rtl8723bs SDIO driver by blacklisting it with 'echo blacklist rtl8723bs | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf' and reboot. Monitor kernel logs for memory corruption issues after mitigation.

Hi! I’m here to help you understand CVE-2026-98160. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70