PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23073 Linux CVE debrief

The Linux kernel's wifi rsi driver has a memory corruption vulnerability due to not setting the vif driver data size. This could lead to memory corruption, system crashes, and potential DoS attacks. The vulnerability is triggered when the rsi_mac80211_add_interface() function writes to the vif->drv_priv, causing an out-of-bounds access. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems with the wifi rsi driver enabled should review and apply patches to fix the issue.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-04
Original CVE updated
2026-10-19
Advisory published
2026-02-04
Advisory updated
2026-10-19

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems with the wifi rsi driver enabled should review and apply patches to fix the issue. They should also monitor system logs for potential crashes or errors related to the wifi rsi driver and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The Linux kernel's wifi rsi driver vulnerability could lead to memory corruption, system crashes, and potential DoS attacks, requiring patching and updates to fix.

  • Memory corruption could lead to system crashes or instability
  • Potential for denial-of-service (DoS) attacks
  • Requires patching and updating Linux kernel to a fixed version

Technical summary

The Linux kernel's wifi rsi driver does not set the vif driver data size, leading to memory corruption when accessing vif->drv_priv. This could cause a system crash. The issue can be fixed by reviewing and applying the provided patches, updating the Linux kernel to a version that includes the fix, and monitoring system logs for potential crashes or errors related to the wifi rsi driver. The vulnerability is triggered when the rsi_mac80211_add_interface() function writes to the vif->drv_priv, causing an out-of-bounds access.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the provided patches to fix the memory corruption vulnerability
  • Update Linux kernel to a version that includes the fix
  • Monitor system logs for potential crashes or errors related to the wifi rsi driver
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Linux kernel's wifi rsi driver does not set the vif driver data size, leading to memory corruption. The vulnerability is triggered when the rsi_mac80211_add_interface() function writes to the vif->drv_priv, causing an out-of-bounds access. The issue can be fixed by reviewing and applying the provided patches, updating the Linux kernel to a version that includes the fix, and monitoring system logs for potential crashes or errors related to the wifi rsi driver.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23073 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23073

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23073 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23073

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • wifi: rsi: Fix memory corruption due to not set vif driver data size

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/23xxx/CVE-2026-23073.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/49ef094fdbc3526e5db2aebb404b84f79c5603dc

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0d7c9e793e351cbbe9e06a9ca47d77b6ad288fb0

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7c54d0c3e2cad4300be721ec2aecfcf8a63bc9f4

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7761d7801f40e61069b4df3db88b36d80d089f8a

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/99129d80a5d4989ef8566f434f3589f60f28042b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/31efbcff90884ea5f65bf3d1de01267db51ee3d1

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4f431d88ea8093afc7ba55edf4652978c5a68f33

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.