Out-of-bounds read in Linux kernel - CVE-2026-90017
Published: September 16, 2026
Vulnerability identifier: #VU150270
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90017
CWE-ID: CWE-125
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in rtw_action_frame_parse() in the rtl8723bs driver when processing a short management action frame. A remote attacker can send a crafted management action frame to cause a denial of service.
The frame can be as short as the 24-byte IEEE 802.11 three-address header.
Affected software
Linux kernel
How to mitigate CVE-2026-90017
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/0b7f64c7bb9664777168768c6b44affb07dcbf24
- https://git.kernel.org/stable/c/136f9a3ab87ded8aaf081425cfb2059659dd9023
- https://git.kernel.org/stable/c/1410bce22351ba15d8e58287cbf09d55d7f21fc9
- https://git.kernel.org/stable/c/15081ff835b29e456da29303b32efc436df04695
- https://git.kernel.org/stable/c/310aaa8058d19cc431aedac0f5bb814e84479393
- https://git.kernel.org/stable/c/a54fd1a44862d263df9f8bc17fca3620be31addb
- https://git.kernel.org/stable/c/b041e3f35e0d262d42a711094ab594634d72744a
- https://git.kernel.org/stable/c/ff917923f4fb9c83717ba135ee47d7e4c1567bb7