Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-22T00:00:00 kernel: staging: rtl8723bs: validate monitor transmit frame lengths 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes. Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.

A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. This vulnerability occurs because the `rtw_cfg80211_monitor_if_xmit_entry()` function does not properly validate the length of monitor transmit frames after processing. A remote attacker could exploit this by sending a specially crafted, truncated frame, which may lead to out-of-bounds reads or insufficient data for Ethernet address writes. This could result in information disclosure or a denial of service (DoS).

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-74648 https://nvd.nist.gov/vuln/detail/CVE-2026-74648 https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74648-1dcb@gregkh/T