SB20260812414 - Improper input validation in Linux kernel realtek rtase driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-68120)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the rtase network driver transmit path when processing malformed IPv4 or IPv6 packets for transmission. A local user can send a specially crafted packet to cause a denial of service.

The issue is triggered by specific incomplete TCP or UDP headers and by certain UDP packets using destination ports 319 or 320 with transport data shorter than the required length.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0f54f5048615e4e2802697855ea6374613548301
• https://git.kernel.org/stable/c/1c50efa1faf3a1a96e100b07ec7a2f3164d90bee
• https://git.kernel.org/stable/c/4a4f3aa6af205bee539b5670afa2cd4e4953750e
• https://git.kernel.org/stable/c/fe3a7320711eec6537e4890892f7ab9776d8618f