{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68190", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.373Z", "datePublished": "2026-08-10T12:00:07.764Z", "dateUpdated": "2026-08-10T12:00:07.764Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-10T12:00:07.764Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()\n\nrtw_get_wps_ie() iterates over IE data from network frames without\nvalidating that the IE header and payload fit within the remaining\nbuffer before reading them. Specifically:\n\n- in_ie[cnt + 1] is read without checking cnt + 1 < in_len\n- memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check\n- in_ie[cnt + 1] is used as length without verifying payload fits\n\nAdd bounds checks at the top of the loop body to break early if fewer\nthan 2 bytes remain for the IE header, or if the declared payload\nextends past the end of the buffer. Also require at least 4 bytes of\npayload before comparing the WPS OUI."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_ieee80211.c"], "versions": [{"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "b9d9a4cd2e59df7281992a076464d2536e80c674", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "630fdca3f2437fee3ffd437c4b646ccf84c7be87", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "875479f18835ac11e21a83e88f3d4dc7ccdcd0c4", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "23c31f107b4f8f420a754a45d12599bdb78f9bb8", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "0e95ff792ae0aa6fbad9455943e9e1e4062670e9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_ieee80211.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.2-rc5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b9d9a4cd2e59df7281992a076464d2536e80c674"}, {"url": "https://git.kernel.org/stable/c/630fdca3f2437fee3ffd437c4b646ccf84c7be87"}, {"url": "https://git.kernel.org/stable/c/875479f18835ac11e21a83e88f3d4dc7ccdcd0c4"}, {"url": "https://git.kernel.org/stable/c/23c31f107b4f8f420a754a45d12599bdb78f9bb8"}, {"url": "https://git.kernel.org/stable/c/0e95ff792ae0aa6fbad9455943e9e1e4062670e9"}], "title": "staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_ieee80211.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b9d9a4cd2e59df7281992a076464d2536e80c674", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "630fdca3f2437fee3ffd437c4b646ccf84c7be87", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "875479f18835ac11e21a83e88f3d4dc7ccdcd0c4", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "23c31f107b4f8f420a754a45d12599bdb78f9bb8", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "0e95ff792ae0aa6fbad9455943e9e1e4062670e9", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_ieee80211.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc5", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()\n\nrtw_get_wps_ie() iterates over IE data from network frames without\nvalidating that the IE header and payload fit within the remaining\nbuffer before reading them. Specifically:\n\n- in_ie[cnt + 1] is read without checking cnt + 1 < in_len\n- memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check\n- in_ie[cnt + 1] is used as length without verifying payload fits\n\nAdd bounds checks at the top of the loop body to break early if fewer\nthan 2 bytes remain for the IE header, or if the declared payload\nextends past the end of the buffer. Also require at least 4 bytes of\npayload before comparing the WPS OUI."}], "id": "CVE-2026-68190", "lastModified": "2026-08-10T13:20:06.313", "metrics": {}, "published": "2026-08-10T13:20:06.313", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e95ff792ae0aa6fbad9455943e9e1e4062670e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23c31f107b4f8f420a754a45d12599bdb78f9bb8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/630fdca3f2437fee3ffd437c4b646ccf84c7be87"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/875479f18835ac11e21a83e88f3d4dc7ccdcd0c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b9d9a4cd2e59df7281992a076464d2536e80c674"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Kernel: Out-of-bounds read in rtl8723bs driver can lead to information disclosure", "id": "2513248", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513248"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nstaging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()\nrtw_get_wps_ie() iterates over IE data from network frames without\nvalidating that the IE header and payload fit within the remaining\nbuffer before reading them. Specifically:\n- in_ie[cnt + 1] is read without checking cnt + 1 < in_len\n- memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check\n- in_ie[cnt + 1] is used as length without verifying payload fits\nAdd bounds checks at the top of the loop body to break early if fewer\nthan 2 bytes remain for the IE header, or if the declared payload\nextends past the end of the buffer. Also require at least 4 bytes of\npayload before comparing the WPS OUI.", "A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. The `rtw_get_wps_ie()` function, responsible for processing network frame data, fails to properly validate the size of incoming information elements (IEs). This oversight allows an attacker to trigger an out-of-bounds read, potentially leading to the disclosure of sensitive information or system instability. The vulnerability occurs when the driver attempts to read beyond the allocated buffer due to malformed IE data."], "name": "CVE-2026-68190", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:00:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68190\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68190\nhttps://git.kernel.org/stable/c/0e95ff792ae0aa6fbad9455943e9e1e4062670e9\nhttps://git.kernel.org/stable/c/23c31f107b4f8f420a754a45d12599bdb78f9bb8\nhttps://git.kernel.org/stable/c/630fdca3f2437fee3ffd437c4b646ccf84c7be87\nhttps://git.kernel.org/stable/c/875479f18835ac11e21a83e88f3d4dc7ccdcd0c4\nhttps://git.kernel.org/stable/c/b9d9a4cd2e59df7281992a076464d2536e80c674"], "threat_severity": "Moderate"}