CVE-2026-74649

A flaw was found in the Linux kernel's rtl8723bs driver. A remote attacker, by operating a malicious Access Point (AP), could send a specially crafted Wi-Fi Protected Equivalent Privacy (WEP) shared-key authentication challenge. This could lead to an out-of-bounds write or information disclosure due to a missing length check when processing the challenge text, potentially allowing memory corruption or the exposure of sensitive data.

A flaw was found in the Linux kernel's staging rtl8723bs Wi-Fi driver. The WEP shared-key authentication handler in OnAuthClient() used the attacker-controlled length of the WLAN_EID_CHALLENGE element - up to 255 bytes - to memcpy() into the fixed 128-byte pmlmeinfo->chg_txt buffer without validating it against the required challenge length. A malicious access point within radio range could send a malformed challenge-text element during shared-key authentication, before association and without requiring privileges or user interaction: an oversized element causes an out-of-bounds write of up to 127 bytes that can corrupt kernel memory and crash the system, while an undersized element can cause the driver to echo stale buffer memory, exposing sensitive data. Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are not affected by this flaw because the vulnerable rtl8723bs staging driver code is not present in the shipped Red Hat kernels. The upstream CVE record assigns a higher severity (CVSS 3.1 score of 8.8, Important) than Red Hat's rating (CVSS 3.1 score of 5.5, Moderate).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.