CVE-2026-90018

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()

rtw_get_wps_attr() walks WPS attributes inside a WPS IE taken from

a wireless management frame. For each candidate attribute it only

checks that the fixed 4-byte attribute header (2-byte ID + 2-byte

length) fits inside the IE:

if (attr_ptr + 4 > wps_ie + wps_ielen)

break;

u16 attr_id = get_unaligned_be16(attr_ptr);

u16 attr_data_len = get_unaligned_be16(attr_ptr + 2);

u16 attr_len = attr_data_len + 4;

attr_data_len (and therefore attr_len) is read directly from the

wire and is never checked against the remaining bytes in the IE

before being used as the size of:

memcpy(buf_attr, attr_ptr, attr_len);

Since attr_len is fully attacker controlled (0 to 65535+4), this is

both a heap OOB read of wps_ie, and, more seriously, a stack buffer

overflow at several call sites where buf_attr is a single-byte

stack variable, e.g. rtw_get_wps_attr_cont

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References