CVE-2026-90016

A one-byte out-of-bounds read exists in rtw_restruct_wmm_ie() in the Linux kernel's staging rtl8723bs driver (Realtek RTL8723BS SDIO Wi-Fi): when the bounds-guarded WMM IE match check fails because the scan position is within 5 bytes of the buffer end, execution still falls through to i += (in_ie[i + 1] + 2), reading in_ie[i + 1] one byte past the buffer. An attacker within Wi-Fi range can trigger it using attacker-influenced IE data built from association/scan traffic, crafted so the scan reaches the last byte without finding a WMM IE. Per the CVSS vector (AV:A/AC:L/PR:N/UI:N, C:L/I:N/A:H), an attacker gains limited confidentiality impact (possible small information disclosure) and potentially high availability impact (kernel crash/denial of service), with no integrity impact. Affected users are those running Linux systems that use the in-kernel staging rtl8723bs driver; the advisory data does not specify exact vulnerable or fixed kernel version numbers. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known.

What to do: Update affected systems to a kernel that includes the new bounds check in rtw_restruct_wmm_ie() (watch distro kernel advisories for the backported fix, as the earlier commit a75281626fc8f was insufficient). As a mitigation, unload or blacklist the r8723bs module on Linux systems not using RTL8723BS Wi-Fi, and avoid associating with or scanning untrusted wireless networks in range of this driver until patched.