CVE-2026-90016

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

rtw_restruct_wmm_ie() scans in_ie for a WMM IE with:

while (i < in_len) {

...

if (i + 5 < in_len && in_ie[i] == 0xDD && ...) {

...

break;

}

i += (in_ie[i + 1] + 2); /* to the next IE element */

}

When the "i + 5 < in_len" match check fails simply because i is

within 5 bytes of the end of the buffer (i.e. no WMM IE was found

near the tail of in_ie), execution falls through to

"i += (in_ie[i + 1] + 2)", which reads in_ie[i + 1]. If i == in_len

- 1 at that point, this is a 1-byte out-of-bounds read of an

attacker-influenced IE buffer built from association/scan data.

Commit a75281626fc8f ("staging: rtl8723bs: fix potential

out-of-bounds read in rtw_restruct_wmm_ie") added the "i + 5 <

in_len" guard to the match condition itself, but did not add an

equivalent guard before the fallthrough advance, so the same class

of OOB read remained reachable

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References