{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-90017",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-90017"
  ],
  "published": "2026-09-16T10:32:03Z",
  "summary": "staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in rtw_action_frame_parse()\n\nrtw_action_frame_parse() takes a frame_len parameter but never\nactually checks it before indexing into the frame body:\n\n\tconst u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);\n\t...\n\tc = frame_body[0];\n\t...\n\ta = frame_body[1];\n\nframe_body already points 24 bytes (sizeof(struct\nieee80211_hdr_3addr)) into frame, so reading frame_body[0] and\nframe_body[1] requires frame_len >= 26. A management action frame\nshorter than that (e.g. exactly 24 bytes, the minimum a malicious\npeer can send) causes a 1-2 byte out-of-bounds read.\n\nThis is reachable from rtw_cfg80211_monitor_if_xmit_entry() and\ncfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass\nattacker/user-influenced frame buffers and lengths straight through.\n\nAdd the missing length check before frame_body is dereferenced.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90017"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/15081ff835b29e456da29303b32efc436df04695"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/310aaa8058d19cc431aedac0f5bb814e84479393"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1410bce22351ba15d8e58287cbf09d55d7f21fc9"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0b7f64c7bb9664777168768c6b44affb07dcbf24"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/136f9a3ab87ded8aaf081425cfb2059659dd9023"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b041e3f35e0d262d42a711094ab594634d72744a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a54fd1a44862d263df9f8bc17fca3620be31addb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ff917923f4fb9c83717ba135ee47d7e4c1567bb7"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-16T14:40:32Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.1,
      "cvss_v3_severity": "High",
      "scenario": "AV:A - rtw_action_frame_parse() is reached from rtw_cfg80211_rx_action() on received 802.11 public action frames (OnAction \u2192 on_action_public \u2192 on_action_public_default). A nearby attacker can inject a truncated management action frame over Wi-Fi; kernel CNA guidance maps Wi-Fi frame injection to Adjacent.\nAC:L - An adjacent attacker fully controls the action-frame length and 802.11 header. A 24- or 25-byte management action frame (header only, or header plus category) reliably hits the missing length check with no race or attacker-uncontrollable layout.\nPR:N - Public action frames are dispatched by mgt_dispatcher()/OnAction() with only a local-MAC match and no association or 802.11 authentication against the sender, so no local account or capability is required.\nUI:N - The rtl8723bs driver processes received management action frames automatically while the interface is up; no extra victim click, mount, or connect action is required at exploit time.\nS:U - The out-of-bounds read occurs in the host rtl8723bs driver and does not cross a VM, IOMMU, or other security-authority boundary.\nC:L - The flaw reads only one or two bytes past a truncated 24- or 25-byte action frame. Per kernel CNA guidance this is a strictly bounded out-of-bounds read, not an arbitrary read primitive.\nI:N - The bug is a read-only out-of-bounds access of the category/action bytes; those values are not used to write kernel memory or hijack control flow.\nA:H - A 1-2 byte kernel out-of-bounds read can oops or panic on KASAN, redzone, or hardened kernels, and an adjacent peer can repeat truncated action frames to deny availability."
    }
  }
}