Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151284)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151284 advisory. In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp IE loop The IE parsing loop in OnAssocRsp advances by pIE-length + 2 each iteration but only guards on i length from pframepktlen, which is one byte past the allocated receive buffer...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth contains two bugs in its shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops fail to perform header bounds checks prior to dereferencing pIE-length: - issueassocreq iterates through pmlmeinfo-network.ies to...

CVE-2026-90017

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. A remote attacker can exploit an out-of-bounds read vulnerability in the rtwactionframeparse function by sending a specially crafted management action frame. This can lead to the disclosure of sensitive information from kernel memory...

CVE-2026-90016

A flaw was found in the rtl8723bs Wi-Fi driver within the Linux kernel. An out-of-bounds read vulnerability exists in the rtwrestructwmmie function due to an insufficient bounds check when processing Wi-Fi Information Elements IEs. A remote attacker could exploit this by sending specially crafted...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr processes WPS attributes within a WPS IE extracted from a wireless management frame. For each attribute candidate, it merely verifies whether the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtwcfg80211setwpaie supplicantie is a 256-byte array in struct securitypriv. The WPA and WPA2 IE copy paths use: memcpypadapter-securitypriv.supplicantie, &pwpa0, wpaielen + 2; wher...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146688)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146688 advisory. In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146281)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146281 advisory. In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: initialize letmp64 in rtwBIPverify Initialize letmp64 to zero in rtwBIPverify to prevent use of uninitialized data. Smatch warns that only 6 bytes are copied to this 8-byte u64 variable, leaving the last two...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: properly validate the data in rtwgetieex Just like in commit 154828bf9559 “staging: rtl8723bs: fix out-of-bounds read in rtwgetie parser”, we don’t trust the data in the frame so we should check the length...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix potential out-of-bounds read in rtwrestructwmmie The current code checks ‘i + 5 inlen’ at the end of the if statement. However, it accesses ‘iniei + 5’ before that check, which can lead to an out-of-bounds...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Staging: rtl8723bs – fixed a potential memory leak in rtwinitcmdpriv. In rtwinitcmdpriv, if pcmdpriv-rspallocatedbuf is allocated incorrectly, then pcmdpriv-cmdallocatedbuf will not be released properly. Additionally, since there...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

Astra Linux – vulnerability in linux-5.15, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8723bs: Fix deadlock in rtwsurveydoneeventcallback There is a deadlock in rtwsurveydoneeventcallback, as shown below: Thread 1 | Thread 2 | settimer rtwsurveydoneeventcallback| modtimer spinlockbh //1 | wait ...

ROS-20261009-73-0352

The vulnerability of the drivers/staging/rtl8723bs/osdep/ioctlcfg80211.c component in the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...