The Linux kernel rtl8723bs staging driver contained a vulnerability (CVE-2026-74650) in the WMM_param_handler() function, which copies a fixed-size WMM parameter element (18 bytes) from a received information element without verifying that the element's length is sufficient (at least 24 bytes). Two callers of this function only verify the WMM OUI length but do not check the full required length, allowing a crafted vendor-specific IE with a WMM OUI but insufficient length to cause an out-of-bounds read. This can be triggered remotely by an access point sending a malformed association response frame. The vulnerability was resolved by moving the length check into the handler itself, ensuring all callers perform proper bounds validation.

The vulnerability allows an out-of-bounds read in kernel memory when processing malformed WMM information elements in association response frames. While the exact impact is not detailed, out-of-bounds reads can lead to information disclosure or kernel instability. The flaw is remotely reachable from a peer access point, increasing the attack surface. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel rtl8723bs staging driver by adding proper length validation inside the WMM_param_handler() function to prevent out-of-bounds reads. Users should update to the fixed kernel version containing this patch. Since this is not a cloud service, remediation requires applying the official kernel update. Patch status is not explicitly confirmed here; users should consult the vendor advisory or kernel release notes for the exact fixed version and apply updates accordingly.