In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths… (CVE-2026-74648)
A vulnerability in the Linux kernel's rtl8723bs staging driver was resolved by validating monitor transmit frame lengths. The function rtw_cfg80211_monitor_if_xmit_entry() previously removed the radiotap header and read the 802.11 frame control field without verifying that a base 802.11 header remained, potentially causing out-of-bounds reads or insufficient data for Ethernet address writes. The fix rejects frames lacking the base 802.11 header or incomplete calculated header spans.
AI Analysis
Technical Summary
The Linux kernel rtl8723bs staging driver contained a vulnerability where the function rtw_cfg80211_monitor_if_xmit_entry() removed the radiotap header and then accessed the 802.11 frame control field without confirming the presence of a base 802.11 header. Additionally, the data path pulled the calculated 802.11, QoS, and SNAP header spans before verifying that the socket buffer (skb) contained sufficient data. This could lead to out-of-bounds reads or insufficient data for Ethernet address writes when processing truncated frames. The vulnerability was addressed by rejecting frames that do not contain the base 802.11 header and data frames missing their complete calculated header span.
Potential Impact
This vulnerability could allow out-of-bounds memory reads or improper handling of truncated frames in the rtl8723bs driver, potentially leading to kernel memory corruption or instability. However, no known exploits in the wild have been reported. The impact is limited to the affected driver within the Linux kernel.
Mitigation Recommendations
A fix has been applied to the Linux kernel rtl8723bs staging driver to validate monitor transmit frame lengths and reject malformed frames. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation.
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths… (CVE-2026-74648)
Description
A vulnerability in the Linux kernel's rtl8723bs staging driver was resolved by validating monitor transmit frame lengths. The function rtw_cfg80211_monitor_if_xmit_entry() previously removed the radiotap header and read the 802.11 frame control field without verifying that a base 802.11 header remained, potentially causing out-of-bounds reads or insufficient data for Ethernet address writes. The fix rejects frames lacking the base 802.11 header or incomplete calculated header spans.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel rtl8723bs staging driver contained a vulnerability where the function rtw_cfg80211_monitor_if_xmit_entry() removed the radiotap header and then accessed the 802.11 frame control field without confirming the presence of a base 802.11 header. Additionally, the data path pulled the calculated 802.11, QoS, and SNAP header spans before verifying that the socket buffer (skb) contained sufficient data. This could lead to out-of-bounds reads or insufficient data for Ethernet address writes when processing truncated frames. The vulnerability was addressed by rejecting frames that do not contain the base 802.11 header and data frames missing their complete calculated header span.
Potential Impact
This vulnerability could allow out-of-bounds memory reads or improper handling of truncated frames in the rtl8723bs driver, potentially leading to kernel memory corruption or instability. However, no known exploits in the wild have been reported. The impact is limited to the affected driver within the Linux kernel.
Mitigation Recommendations
A fix has been applied to the Linux kernel rtl8723bs staging driver to validate monitor transmit frame lengths and reject malformed frames. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m738-m8ph-wwcp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74648"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8a27f1acd9273b499bc7a4
Added to database: 08/22/2026, 22:51:29 UTC
Last enriched: 08/23/2026, 00:09:53 UTC
Last updated: 08/23/2026, 01:12:14 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.