CVE-2026-100076: Linux kernel · staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in c48e5aa01525577d6b6e782962a5bfb0e1535cb5 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 17:30 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in c48e5aa01525577d6b6e782962a5bfb0e1535cb5, 17260b5215d4ced17a733e2c027a76290e476fad, 41b8209376dffbd7b0b85c8bc4697d9166ac62ef +2
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from the driver's fixed-size management-TX pools via alloc_mgtxmitframe(). On the normal path the frame is handed to dump_mgntframe(), which transfers ownership and eventually returns both objects to their pools (the frame and, for beacons, the buf in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion path). Several error/edge paths return early after a successful alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never transferred and neither object is freed: - issue_beacon(): beacon larger than 512 bytes - issue_probersp(): cur_network->ie_length > MAX_IE_SZ - issue_probersp(): kzalloc() of the SSID scratch buffer fails - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP Because alloc_mgtxmitframe() removes the frame and buf from their free lists (list_del_init) without placing them on any pending list, an orphaned pair is on no list and referenced by nobody, so it is only reclaimed at driver teardown. Repeated hits progressively exhaust the management-TX pools until alloc_mgtxmitframe() returns NULL and the interface can no longer send beacons or probe/assoc responses. Free the frame and buffer on these paths, matching the existing correct error handling in issue_assocreq().
References
- git.kernel.org/stable/c/17260b5215d4ced17a733e2c027a76290e476fad (opens in a new tab)
- git.kernel.org/stable/c/2f5e2752c2b4bad01df4523cfe2b41b702c60f00 (opens in a new tab)
- git.kernel.org/stable/c/6c9f6a3b9fdd31a0836b681053155b5997c0156e (opens in a new tab)
- git.kernel.org/stable/c/c48e5aa01525577d6b6e782962a5bfb0e1535cb5 (opens in a new tab)
- git.kernel.org/stable/c/41b8209376dffbd7b0b85c8bc4697d9166ac62ef (opens in a new tab)