Vulnerability-Lookup

GHSA-M738-M8PH-WWCP

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: validate monitor transmit frame lengths

rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains.

The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes.

Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74648"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:38Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: validate monitor transmit frame lengths\n\nrtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and\nthen reads the 802.11 frame control field without checking that a base\n802.11 header remains.\n\nThe data path also pulls the calculated 802.11, QoS and SNAP header\nspan before confirming that the skb contains it. A truncated frame can\ntherefore cause out-of-bounds reads or leave insufficient data for the\nEthernet address writes.\n\nReject frames that do not contain the base 802.11 header and data\nframes that do not contain their complete calculated header span.",
  "id": "GHSA-m738-m8ph-wwcp",
  "modified": "2026-08-25T06:31:25Z",
  "published": "2026-08-22T18:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74648"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6829665d050983907b560173e49dcc6c11cb2730"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7b0f62d2986a28e5e4188366bc2f4e2868b14790"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7edd3adb0c80d70b4237640275c559610f438476"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8b3e4ed9c35d3d3b64fcc23f4a1f22b37c1865b1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a3ac6d849de5f7abe14761d741bbb843ac793454"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd88f6289b7e483216a9c1df15a0460ef9b02cb6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c5e5d78743992e235b76d2ebe5a403d60315aa8a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f03398d835f5249c49546f0eb0d0df6792b95d5f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74648 (GCVE-0-2026-74648)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41

Title

staging: rtl8723bs: validate monitor transmit frame lengths

Summary

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes. Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6667 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/f03398d835f5249c4…
https://git.kernel.org/stable/c/a3ac6d849de5f7abe…
https://git.kernel.org/stable/c/7edd3adb0c80d70b4…
https://git.kernel.org/stable/c/c5e5d78743992e235…
https://git.kernel.org/stable/c/7b0f62d2986a28e5e…
https://git.kernel.org/stable/c/8b3e4ed9c35d3d3b6…
https://git.kernel.org/stable/c/bd88f6289b7e48321…
https://git.kernel.org/stable/c/6829665d050983907…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < f03398d835f5249c49546f0eb0d0df6792b95d5f (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < a3ac6d849de5f7abe14761d741bbb843ac793454 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 7edd3adb0c80d70b4237640275c559610f438476 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < c5e5d78743992e235b76d2ebe5a403d60315aa8a (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 7b0f62d2986a28e5e4188366bc2f4e2868b14790 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 8b3e4ed9c35d3d3b64fcc23f4a1f22b37c1865b1 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < bd88f6289b7e483216a9c1df15a0460ef9b02cb6 (git) Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6829665d050983907b560173e49dcc6c11cb2730 (git)
Linux	Linux	Affected: 4.12 Unaffected: 0 , < 4.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f03398d835f5249c49546f0eb0d0df6792b95d5f",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "a3ac6d849de5f7abe14761d741bbb843ac793454",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "7edd3adb0c80d70b4237640275c559610f438476",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "c5e5d78743992e235b76d2ebe5a403d60315aa8a",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "7b0f62d2986a28e5e4188366bc2f4e2868b14790",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "8b3e4ed9c35d3d3b64fcc23f4a1f22b37c1865b1",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "bd88f6289b7e483216a9c1df15a0460ef9b02cb6",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "6829665d050983907b560173e49dcc6c11cb2730",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: validate monitor transmit frame lengths\n\nrtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and\nthen reads the 802.11 frame control field without checking that a base\n802.11 header remains.\n\nThe data path also pulls the calculated 802.11, QoS and SNAP header\nspan before confirming that the skb contains it. A truncated frame can\ntherefore cause out-of-bounds reads or leave insufficient data for the\nEthernet address writes.\n\nReject frames that do not contain the base 802.11 header and data\nframes that do not contain their complete calculated header span."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is only reachable via local userspace transmitting crafted radiotap skbs to the rtl8723bs monitor netdev ndo_start_xmit handler (cfg80211 NEW_INTERFACE + packet socket/dev_queue_xmit); remote WiFi peers cannot drive this transmit-only parsing path.\nAC:L - An attacker fully controls monitor TX skb length and 802.11 header fields after the fixed 14-byte radiotap prefix; sending a truncated frame (e.g., radiotap-only or short DATA header) reliably triggers the missing bounds checks without races or layout dependencies.\nPR:L - Exploitation requires creating a monitor virtual interface via nl80211 (GENL_UNS_ADMIN_PERM/CAP_NET_ADMIN) and injecting frames via CAP_NET_RAW packet sockets; per kernel CNA guidance these capabilities are PR:L when obtainable through user namespaces on embedded rtl8723bs systems.\nUI:N - No victim interaction is required once the attacker can create or access the monitor interface; exploitation is a direct syscall/netlink and packet-socket operation without needing the user to connect, mount, or approve an action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the host kernel running the rtl8723bs SDIO WiFi driver; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Reading dot11_hdr-\u003eframe_control and memcpy of addr1/addr2 without verifying at least 24 bytes remain after radiotap removal causes out-of-bounds kernel reads of adjacent skb and kmalloc memory, enabling information disclosure.\nI:H - On the DATA path, skb_pull and subsequent memcpy of 12-byte Ethernet addresses into skb-\u003edata without ensuring sufficient tail room can write past the skb buffer end, providing exploitable heap corruption for arbitrary kernel writes.\nA:H - Out-of-bounds reads and writes in kernel softirq transmit context on SDIO WiFi embedded devices (CHIP, Intel Compute Stick, ARM SBCs) can trigger kernel oops, panic, or hang, causing complete loss of availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:06.779Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f03398d835f5249c49546f0eb0d0df6792b95d5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3ac6d849de5f7abe14761d741bbb843ac793454"
        },
        {
          "url": "https://git.kernel.org/stable/c/7edd3adb0c80d70b4237640275c559610f438476"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5e5d78743992e235b76d2ebe5a403d60315aa8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b0f62d2986a28e5e4188366bc2f4e2868b14790"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b3e4ed9c35d3d3b64fcc23f4a1f22b37c1865b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd88f6289b7e483216a9c1df15a0460ef9b02cb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6829665d050983907b560173e49dcc6c11cb2730"
        }
      ],
      "title": "staging: rtl8723bs: validate monitor transmit frame lengths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74648",
    "datePublished": "2026-08-22T15:32:24.858Z",
    "dateReserved": "2026-08-15T05:44:03.923Z",
    "dateUpdated": "2026-08-25T05:41:06.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted