CVE-2026-74648

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. This vulnerability occurs because the rtw_cfg80211_monitor_if_xmit_entry() function does not properly validate the length of monitor transmit frames after processing. A remote attacker could exploit this by sending a specially crafted, truncated frame, which may lead to out-of-bounds reads or insufficient data for Ethernet address writes. This could result in information disclosure or a denial of service (DoS).

A moderate severity out-of-bounds read flaw was found in the Linux kernel's staging rtl8723bs Wi-Fi driver. The rtw_cfg80211_monitor_if_xmit_entry() monitor-mode transmit path removes the radiotap header and then reads the 802.11 frame control field, and pulls the calculated 802.11, QoS, and SNAP header span, without first verifying that a truncated frame actually contains that data. An attacker able to inject crafted, truncated frames through a monitor-mode interface on an affected system could exploit this flaw to trigger out-of-bounds reads, resulting in limited information disclosure or a kernel crash causing denial of service. Red Hat rates this flaw as moderate impact because exploitation requires local access to transmit frames on a monitor-mode interface and the primary consequence is loss of availability (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This differs from the upstream CVEORG severity of 7.8, which assumes high confidentiality and integrity impact; Red Hat's assessment found the practical impact limited to availability. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable rtl8723bs staging driver code is not present in the Red Hat shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.