CVE-2026-90016

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the rtw restruct wmm ie() function within the rtl8723bs staging driver. The issue occurs when the function scans the in ie buffer for a WMM IE; if the match check fails because the index i is within 5 bytes of the end of the buffer, the execution proceeds to advance the index using in ie[i + 1]. If i is exactly one byte before the end of the buffer, this results in a 1-byte out-of-bounds read of an attacker-influenced buffer constructed from association or scan data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.