PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46305 Linux CVE debrief

A vulnerability has been resolved in the Linux kernel, specifically in the staging: rtl8723bs: os_dep module. The vulnerability is related to a potential NULL pointer dereference in the rtw_cbuf_alloc function. The issue arises from the return value of kzalloc_flex() being used without ensuring that the allocation succeeded, and the pointer being dereferenced unconditionally. To mitigate this vulnerability, it is recommended to guard the access to the allocated structure to avoid a potential NULL pointer dereference if the allocation fails.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel, particularly those using the rtl8723bs module, should be aware of this vulnerability and take necessary precautions.

Technical summary

The vulnerability is caused by a NULL pointer dereference in the rtw_cbuf_alloc function. The function uses the return value of kzalloc_flex() without checking if the allocation was successful, leading to a potential NULL pointer dereference.

Defensive priority

Medium

Recommended defensive actions

  • Apply the patch from the Linux kernel repository to fix the vulnerability.
  • Use resourceLinkAnnotations for more information: {ref-4} and {ref-5}.

Evidence notes

The vulnerability has been resolved in the Linux kernel repository.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46305 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46305

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46305 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46305

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0a5f411becfb7c57aa89827213d31ef23a03d75a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bc851db06045a40c18233dd76ef0562d7f8bb6db

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.