CVE-2026-74651 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel security, particularly those using the rtl8723bs module, should assess exposure and prioritize patching. Operators of systems using the Linux kernel with the rtl8723bs module should review system configurations and monitor system logs for potential exploitation attempts. Security teams should verify the Linux kernel version and apply patches to address this vulnerability.

Why it matters

The Linux kernel vulnerability in the staging: rtl8723bs module can lead to an out-of-bounds read, potentially allowing attackers to access sensitive information.

• Verify Linux kernel version for patch availability
• Assess system configurations for rtl8723bs module usage
• Monitor system logs for potential exploitation attempts

Technical summary

The rtw_get_wpa_ie() function in the Linux kernel's staging: rtl8723bs module does not check the length of vendor-specific information elements before reading from them, leading to a potential out-of-bounds read. The function reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE. The buffer holds information elements taken from received management frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie().

Defensive priority

Defenders should prioritize verifying the Linux kernel version and applying patches to address this vulnerability, particularly for systems using the rtl8723bs module.

Recommended defensive actions

• Verify Linux kernel version and apply patches
• Review system configurations for rtl8723bs module usage
• Monitor system logs for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability is caused by the rtw_get_wpa_ie() function not checking the length of the vendor-specific information element before reading from it. This can lead to an out-of-bounds read when the element is short. The function locates a vendor-specific IE (EID 221) with rtw_get_ie() and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte version word at pbuf + 6. Those accesses require the IE body to be at least 6 bytes, but rtw_get_ie() only guarantees that the element fits within the buffer; it does not enforce a The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.