CVE-2026-74649

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The WEP shared-key authentication handler in the rtl8723bs staging driver fails to validate the length of the challenge-text element. In the OnAuthClient() function, the length obtained via rtw get ie() (which can be up to 255 bytes) is used in a memcpy() operation into the 128-byte pmlmeinfo->chg txt buffer. A malicious access point sending a malformed WLAN EID CHALLENGE element can cause a buffer overflow of up to 127 bytes, leading to out-of-bounds writes, or an underfill, which may result in the driver echoing stale buffer memory. This issue is reachable over the air during shared-key authentication before association.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.