LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68255: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow. Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow. This prevents kernel stack corruption triggered by malformed association requests.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A nearby malicious Wi-Fi device can send a malformed association request to a Linux system using the rtl8723bs wireless driver. The request may overwrite kernel stack memory, potentially crashing the system or compromising confidentiality and integrity. No authentication or user action is required, but the attacker must be within wireless reach.

Executive priority

Prioritize exposed wireless infrastructure and embedded devices using rtl8723bs. The potential impact is severe, but reachability requires nearby radio access and active exploitation is not established. Complete targeted inventory promptly, then patch confirmed exposures through supported distribution channels.

Technical view

The rtl8723bs OnAssocReq parser copied an attacker-controlled Supported Rates IE into a 16-byte stack buffer without limiting its length. Extended Supported Rates handling contained another unsafe bounds check. Linux stable fixes clamp the first copy and correct the merge check, preventing kernel stack corruption.

Likely exposure

Exposure is limited to Linux systems using the staging rtl8723bs driver in a role that processes incoming Wi-Fi association requests. Systems without this driver or relevant hardware are unlikely to be exposed. The supplied version data is ambiguous and includes commit identifiers, so distribution-specific kernel mapping is required.

Exploitation context

The CVSS 3.1 score is 8.8 with adjacent-network access, low complexity, no privileges, and no user interaction. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Practical attacks require wireless proximity and a vulnerable processing path.

Researcher notes

The vulnerable sink is a fixed 16-byte supportRate stack buffer receiving attacker-controlled IE data. The correction addresses both the initial Supported Rates copy and Extended Supported Rates merge arithmetic. The supplied sources do not establish exploitability beyond kernel stack corruption, affected distribution packages, or observed attacks.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable Linux stable fix.
  • Check distribution security advisories for the corrected package version and reboot requirements.
  • Where upgrading is delayed, disable unused rtl8723bs hardware or driver functionality after operational review.
  • Restrict affected systems from operating roles that accept Wi-Fi association requests where feasible.

Validation and detection

  • Inventory systems for rtl8723bs hardware, loaded modules, and relevant wireless operating modes.
  • Record kernel and distribution package versions, then compare them with vendor advisories.
  • Confirm the installed kernel incorporates an applicable referenced stable commit or vendor backport.
  • After remediation, verify the corrected kernel is running and the previous package is not active.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68255 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2025-68255Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290bunaffected
LinuxLinux4.12, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.62, 6.17.12, 6.18.1, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.