CVE-2026-90017

CVE-2026-90017 is a missing length-validation flaw in rtw_action_frame_parse() in the Linux kernel's staging driver for Realtek RTL8723BS SDIO Wi-Fi adapters: the function reads frame_body[0] and frame_body[1] (bytes 25-26 of the frame) without ever checking the frame_len it was given, so an 802.11 management action frame shorter than 26 bytes (e.g., the 24-byte minimum a peer can send) causes a 1-2 byte out-of-bounds read. It is reachable through rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx(), which pass attacker/user-influenced frame buffers and lengths straight through, so a malicious peer within wireless range (adjacent-network access per the CVSS vector) can trigger it. An attacker gains limited information disclosure and, per the 7.1 (High) CVSS score, potentially a kernel crash, with availability impact rated high. Affected systems are any Linux machines using the mainline staging rtl8723bs driver, typically budget tablets, mini-PCs and TV sticks built around the RTL8723BS chip. No public proof-of-concept and no in-the-wild exploitation are known, and the flaw is not on CISA KEV.

What to do: Update the kernel to a build that includes the staging rtl8723bs fix, which adds the missing frame_len check in rtw_action_frame_parse(), as soon as your distribution ships it. Until patched, check whether the driver is in use (lsmod for the rtl8723bs/r8723bs module or kernel CONFIG_RTL8723BS) and on unpatched systems near untrusted wireless peers, unload or blacklist the module or avoid monitor-interface/mgmt_tx frame injection. No public exploit is known, so exposure is concentrated on hobbyist and embedded Linux devices within radio range of a hostile peer.