VulnerabilityPublished 22 Aug 2026Updated 9 Oct 2026

CVE-2026-74650: Linux kernel · staging: rtl8723bs: fix OOB read in WMM_param_handler()

Affects Linux kernelSource GCVE Database

Not known to be exploited · fixed in 5.15.0-1117.124~20.04.1 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 5.15.0-1117.124~20.04.1, 5.15.0-1123.132~20.04.1, 5.15.0-1122.131~20.04.1 +26

Exploitation evidence

Disclosed: evidence found.
CVE published 22 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-96vf-829x-rg43

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
Ubuntu 26.04 LTSlinux`pkg:deb/ubuntu/linux?arch=source&distro=resolute`Other threats	Affected 6.17.0-5.5 – 7.0.0-38.38 23 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-aws`pkg:deb/ubuntu/linux-aws?arch=source&distro=resolute`Other threats	Affected 6.17.0-1002.2 – 7.0.0-1014.14 15 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-azure`pkg:deb/ubuntu/linux-azure?arch=source&distro=resolute`Other threats	Affected 6.17.0-1003.3 – 7.0.0-1017.17 15 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-azure-fde`pkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resolute`Other threats	Affected 7.0.0-1003.3 – 7.0.0-1016.16 9 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-gcp`pkg:deb/ubuntu/linux-gcp?arch=source&distro=resolute`Other threats	Affected 6.17.0-1002.2 – 7.0.0-1014.14 13 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-gke`pkg:deb/ubuntu/linux-gke?arch=source&distro=resolute`Other threats	Affected 7.0.0-1002.3 – 7.0.0-1008.9 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and should be applied to affected Linux kernel versions. The fix adds proper length validation in the WMM_param_handler() function to prevent out-of-bounds reads. Users should update to patched kernel versions as provided by their Linux distribution vendors. No additional mitigations are indicated by the vendor advisory.

Description

A vulnerability in the Linux kernel's rtl8723bs staging driver caused an out-of-bounds read in the WMM_param_handler() function. This occurs because the handler copies a fixed-size WMM parameter element from a received information element without validating that the element is sufficiently long, leading to memory reads beyond the element's boundary. The flaw can be triggered remotely via a crafted association response or vendor-specific information element containing a WMM OUI with an insufficient length. The issue has been fixed by adding proper length validation within the handler itself.

Impact

The vulnerability allows an attacker controlling the access point or the network to cause an out-of-bounds read in the kernel memory by sending malformed association response frames or vendor-specific information elements. This could potentially lead to system instability or crashes (denial of service). There is no evidence of privilege escalation or code execution from the provided data.

Summary

The Linux kernel rtl8723bs staging driver contained a vulnerability (CVE-2026-74650) where WMM_param_handler() performed an out-of-bounds read by copying 18 bytes from an information element without verifying that the element's length was at least 24 bytes. Two of the three callers to this handler only verified the WMM OUI length partially, allowing a crafted vendor-specific IE with a length between 6 and 23 bytes to trigger the out-of-bounds read. This vulnerability is reachable remotely via association response frames from an access point. The fix involved moving the length check into the handler to ensure all callers validate the element length before access.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Oct 2026, 05:35 UTC

Technical details

References

Community reviews

Related threats