--- cve: "CVE-2026-74650" severity: "LOW" cvss: 3.1 epss: "6%" vendor: "Linux" kev: false exploited: false published: "2026-08-22 16:16:38" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-07T09:47:45+02:00" --- # CVE-2026-74650 > 3.1 LOW ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMM_param_handler() WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE. The handler reads sizeof(struct WMM_para_element) (18) bytes at pIE->data + 6, so it requires pIE->length to be at least 24 (WLAN_WMM_LEN), but it never validates the length. Two of its three callers reach it after matching only the WMM OUI: OnAssocRsp() in rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a 4-byte OUI, before calling the handler. A vendor-specific IE carrying the WMM OUI but a length between 6 and 23, placed in an association response or in the IE blob handed to join_cmd_hdl(), passes the OUI check and then makes the memcmp() and memcpy() at pIE->data + 6 read past the end of the element. OnAssocRsp() parses a frame received from the AP, so this is reachable from a remote peer. The remaining caller in rtw_wlan_util.c already guards the handler with "pIE->length == WLAN_WMM_LEN". Move the equivalent check into the handler itself so every caller is covered; the sibling IE handlers in the same parsing loop (HT_caps_handler(), HT_info_handler(), ERP_IE_handler()) likewise bound their accesses by pIE->length. ## Patch verfügbar (OSV) - Kernel ≥ 5.10.267 - Kernel ≥ 5.15.216 - Kernel ≥ 6.1.183 - Kernel ≥ 6.6.152 - Kernel ≥ 6.12.104 - Kernel ≥ 6.18.45 - Kernel ≥ 7.1.9 ## Referenzen - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-74650) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_