CVE-2026-90017

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the rtw action frame parse() function within the rtl8723bs staging driver. The function accepts a frame len parameter but fails to validate it before indexing into the frame body. Because the frame body pointer is offset by 24 bytes, reading the first two bytes requires a minimum length of 26 bytes. A management action frame shorter than this can trigger a 1-2 byte out-of-bounds read. This issue is reachable via rtw cfg80211 monitor if xmit entry() and cfg80211 rtw mgmt tx() in ioctl cfg80211.c, which process user-influenced frame buffers and lengths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.