CVE-2026-74648
Description
A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. This vulnerability occurs because the rtw_cfg80211_monitor_if_xmit_entry() function does not properly validate the length of monitor transmit frames after processing. A remote attacker could exploit this by sending a specially crafted, truncated frame, which may lead to out-of-bounds reads or insufficient data for Ethernet address writes. This could result in information disclosure or a denial of service (DoS).
Statement
A moderate severity out-of-bounds read flaw was found in the Linux kernel's staging rtl8723bs Wi-Fi driver. The rtw_cfg80211_monitor_if_xmit_entry() monitor-mode transmit path removes the radiotap header and then reads the 802.11 frame control field, and pulls the calculated 802.11, QoS, and SNAP header span, without first verifying that a truncated frame actually contains that data. An attacker able to inject crafted, truncated frames through a monitor-mode interface on an affected system could exploit this flaw to trigger out-of-bounds reads, resulting in limited information disclosure or a kernel crash causing denial of service. Red Hat rates this flaw as moderate impact because exploitation requires local access to transmit frames on a monitor-mode interface and the primary consequence is loss of availability (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This differs from the upstream CVEORG severity of 7.8, which assumes high confidentiality and integrity impact; Red Hat's assessment found the practical impact limited to availability. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable rtl8723bs staging driver code is not present in the Red Hat shipped kernels.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
