Security readout for executives and security teams
Plain-English summary
A nearby attacker could transmit a malformed Wi-Fi beacon that causes a Linux system using the rtl8723bs wireless driver to read beyond a received frame. The documented consequence is a possible kernel panic, disrupting the device. The issue does not require credentials or user interaction, but it requires adjacent-network access and the affected driver.
Executive priority
Treat this as a high-priority availability issue for fleets using rtl8723bs, particularly embedded or operational devices where rebooting is disruptive. It is not an internet-wide remote compromise based on supplied evidence. Quickly identify affected hardware, apply supported kernel updates, and use temporary driver isolation where patching cannot occur promptly.
Technical view
OnBeacon parsed an Extended Supported Rates information element without confirming that two subsequent byte offsets remained inside the frame buffer. An ESR element placed at the buffer’s end could therefore trigger an out-of-bounds read. Linux stable commits add bounds validation before accessing those bytes. CVSS 3.1 is 7.1: adjacent, low complexity, no privileges, low confidentiality impact, and high availability impact.
Likely exposure
Exposure is limited to Linux systems using the staging rtl8723bs driver and a vulnerable kernel revision. Systems without that driver or associated hardware are unlikely to be exposed. The supplied version data is ambiguous, so inventory should rely on distributor advisories and confirmation that the relevant stable fix is present.
Exploitation context
The attack surface is local wireless range: a malicious beacon can be received without authentication or user interaction. The supplied record identifies denial of service through a possible kernel panic and limited confidentiality impact. It provides no evidence of public exploitation, and CVE-2025-68254 is not marked as CISA KEV.
Researcher notes
The vulnerable reads occur at offsets derived from the ESR information-element length. The correction verifies that the ESR body and following bytes remain within the received frame. The bundle lists multiple stable commits, likely for separate kernel branches, but does not map each commit clearly to corrected release versions. No exploit evidence or code-execution impact is supplied.
Mitigation direction
- Install a vendor-supported kernel containing the applicable Linux stable fix.
- Prioritize exposed appliances or endpoints using rtl8723bs wireless hardware.
- Disable the affected driver or wireless interface where operationally acceptable until patched.
- Check distribution guidance for corrected package versions; the supplied version mapping is ambiguous.
Validation and detection
- Inventory kernels, loaded drivers, and hardware to identify rtl8723bs use.
- Confirm the installed kernel includes the applicable referenced boundary-check commit.
- Review kernel logs for wireless parsing faults, crashes, or unexplained panics.
- Retest affected devices after updating without transmitting malicious beacon frames.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68254 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H2.84.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c03cb111628924827351e19baa5b073e9b0d723dCVE reference, Linux
- https://git.kernel.org/stable/c/bb5940193d813449540d8d3a82abc045be41f48aCVE reference, Linux
- https://git.kernel.org/stable/c/c173ce97d3f0f0c0fefa39139d6d04ba60b5db22CVE reference, Linux
- https://git.kernel.org/stable/c/d1ab7f9cee22e7b8a528da9ac953e4193b96cda5CVE reference, Linux
- https://git.kernel.org/stable/c/38292407c2bb5b2b3131aaace4ecc7a829b40b76CVE reference, Linux
- https://git.kernel.org/stable/c/bf323db1d883c209880bd92f3b12503e3531c3fcCVE reference, Linux
- https://git.kernel.org/stable/c/502ddcc405b69fa92e0add6c1714d654504f6fd7CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.