PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43386 Linux CVE debrief

CVE-2026-43386 is a HIGH severity (CVSS 7.1) out-of-bounds read vulnerability in the Linux kernel's staging rtl8723bs Wi-Fi driver. The flaw exists in the `rtw_restruct_wmm_ie` function where the code accesses `in_ie[i + 5]` before verifying that `i + 5 < in_len`, allowing a local attacker with low privileges to trigger an out-of-bounds read. This is classified as CWE-125 (Out-of-bounds Read). The vulnerability affects multiple Linux kernel versions from 4.12 through 7.0-rc3, with patches available for stable branches. The fix reorders the conditional check to validate bounds before array access. No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-26
Advisory published
2026-05-08
Advisory updated
2026-05-26

Who should care

Linux system administrators, embedded device manufacturers using rtl8723bs Wi-Fi chipsets, security teams managing kernel attack surface, and organizations with IoT/embedded Linux deployments

Technical summary

The vulnerability resides in `drivers/staging/rtl8723bs/core/rtw_mlme.c` in the `rtw_restruct_wmm_ie` function. The original code structure checked array bounds after accessing `in_ie[i + 5]`, creating a classic time-of-check vs time-of-use (TOCTOU) pattern for memory safety. The patch moves the length check `i + 5 < in_len` to the beginning of the conditional, ensuring bounds validation precedes any array access. This is a local vulnerability requiring low privileges with no user interaction, impacting confidentiality and availability per CVSS 3.1 scoring.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches (5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.78+, 6.18.19+, 6.19.9+, or 7.0-rc4+) to remediate the out-of-bounds read in rtw_restruct_wmm_ie
  • Verify kernel version against affected CPE ranges and prioritize systems using the rtl8723bs Wi-Fi driver
  • Monitor for kernel updates from distribution maintainers if custom kernel builds are not feasible
  • Review staging driver usage and consider disabling rtl8723bs if not required for system operation

Evidence notes

Vulnerability confirmed via NVD with CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Multiple stable kernel patches released. CPE criteria confirm affected versions across 4.12-5.10.252, 5.11-5.15.202, 5.16-6.1.166, 6.2-6.6.129, 6.7-6.12.77, 6.13-6.18.18, 6.19-6.19.8, and 7.0-rc1 through rc3.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43386 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43386

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43386 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43386

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/209644e25757c499e1c1f08c071ea0386d4448b6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4dd2d9cf563c54e09d5f7eacf95c5b8f538b513b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6ff2243d5e05a5239e39d4ba61d96b0ea3bf7259

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/768f25613a9fe6766d15a4a72979657adfc1c6d8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a75281626fc8fa6dc6c9cc314ee423e8bc45203b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d97fc1b29513010b60fde874c7f0ba816744e18c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.