CVE-2026-74651

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the rtw get wpa ie() function within the rtl8723bs staging driver. The function processes vendor-specific information elements (EID 221) by reading bytes at fixed offsets to compare a 4-byte OUI+type and a 2-byte version word. Because the function fails to verify that the information element body is at least 6 bytes long, a short trailing element can cause the read operation to extend beyond the element and the allocated buffer. This buffer contains data from received management frames or an IE blob passed to rtw cfg80211 set wpa ie(), which is duplicated to its exact length.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.