CVE-2026-74650

A flaw was found in the Linux kernel's Wi-Fi driver (rtl8723bs). This vulnerability occurs because the system does not properly check the size of incoming Wireless Multimedia (WMM) information elements. A remote attacker could exploit this by sending a specially crafted network message, leading to an out-of-bounds read. This could potentially expose sensitive information or cause the system to become unstable.

A moderate out-of-bounds read flaw was found in the Linux kernel's staging rtl8723bs Wi-Fi driver. The WMM_param_handler() function copies a fixed-size WMM parameter element out of a received information element without validating that the element is long enough, and two of its callers reach it after matching only the WMM OUI. A remote attacker, for example a malicious or compromised Wi-Fi access point, could send a crafted association response containing a vendor-specific information element that carries the WMM OUI but is shorter than the required length, causing the memcmp() and memcpy() in the handler to read past the end of the element. This out-of-bounds read can expose adjacent kernel memory and may lead to a kernel panic and system crash. Red Hat Enterprise Linux (including the kernel-rt realtime variant) and Red Hat In-Vehicle OS are not affected by this vulnerability because the rtl8723bs staging driver is not included in the kernel packages shipped by Red Hat; the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.