GHSA-7GCH-C4XX-86RX

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-19 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically:

  • in_ie[cnt + 1] is read without checking cnt + 1 < in_len
  • memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
  • in_ie[cnt + 1] is used as length without verifying payload fits

Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer. Also require at least 4 bytes of payload before comparing the WPS OUI.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-68190"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:06Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()\n\nrtw_get_wps_ie() iterates over IE data from network frames without\nvalidating that the IE header and payload fit within the remaining\nbuffer before reading them. Specifically:\n\n- in_ie[cnt + 1] is read without checking cnt + 1 \u003c in_len\n- memcmp(\u0026in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check\n- in_ie[cnt + 1] is used as length without verifying payload fits\n\nAdd bounds checks at the top of the loop body to break early if fewer\nthan 2 bytes remain for the IE header, or if the declared payload\nextends past the end of the buffer. Also require at least 4 bytes of\npayload before comparing the WPS OUI.",
  "id": "GHSA-7gch-c4xx-86rx",
  "modified": "2026-08-19T18:32:09Z",
  "published": "2026-08-10T15:33:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68190"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0e95ff792ae0aa6fbad9455943e9e1e4062670e9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/23b630e334f7e8f76bb22a18aca350da995af905"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/23c31f107b4f8f420a754a45d12599bdb78f9bb8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/630fdca3f2437fee3ffd437c4b646ccf84c7be87"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/875479f18835ac11e21a83e88f3d4dc7ccdcd0c4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b9d9a4cd2e59df7281992a076464d2536e80c674"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c670efe69ec8a3360bfa596436f0250a3bf15d42"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.