CVE-2026-90017

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

rtw_action_frame_parse() takes a frame_len parameter but never

actually checks it before indexing into the frame body:

const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);

...

c = frame_body[0];

...

a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct

ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and

frame_body[1] requires frame_len >= 26. A management action frame

shorter than that (e.g. exactly 24 bytes, the minimum a malicious

peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and

cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass

attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References