CVE-2026-68190

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

rtw_get_wps_ie() iterates over IE data from network frames without

validating that the IE header and payload fit within the remaining

buffer before reading them. Specifically:

- in_ie[cnt + 1] is read without checking cnt + 1 < in_len

- memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check

- in_ie[cnt + 1] is used as length without verifying payload fits

Add bounds checks at the top of the loop body to break early if fewer

than 2 bytes remain for the IE header, or if the declared payload

extends past the end of the buffer. Also require at least 4 bytes of

payload before comparing the WPS OUI.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References