LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68256: staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop. Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element. This prevents OOB reads and ensures the parser terminates safely on malformed frames.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A malformed nearby wireless frame can make the Linux rtl8723bs Wi-Fi driver read beyond its buffer or stop processing indefinitely. Systems using this staging driver could experience crashes or unintended data exposure. The supplied record rates it 8.8 high severity, but does not establish code execution or active exploitation.

Executive priority

Prioritize exposed embedded, appliance, and endpoint fleets that use rtl8723bs, especially where nearby untrusted wireless transmitters are plausible. Treat this as a high-priority patching and inventory issue, but not as a confirmed active-compromise emergency based on the supplied evidence.

Technical view

The rtw_get_ie() Information Element parser trusted an attacker-controlled length byte without confirming the declared body remained within the frame buffer. Pointer advancement could therefore cross the buffer boundary, causing out-of-bounds reads or an infinite loop. The kernel fix rejects elements when offset plus header and declared length exceeds the limit.

Likely exposure

Exposure is limited to Linux systems using the staging rtl8723bs wireless driver and processing attacker-supplied malformed frames within adjacent-network reach. The supplied affected-version data is ambiguous and includes hashes and unusual version entries, so kernel version alone is insufficient for reliable determination.

Exploitation context

The CVSS vector describes adjacent-network access, low complexity, no privileges, and no user interaction. The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Practical impact demonstrated by the sources is limited to out-of-bounds reads or an infinite loop.

Researcher notes

The record supplies no CWE and does not demonstrate corruption beyond an out-of-bounds read or non-termination. Seven stable-tree commit references appear to represent branch-specific backports. Exact vulnerable and fixed release boundaries cannot be stated confidently because the affected-version entries are inconsistent; validate against distributor backport records and commit ancestry.

Mitigation direction

  • Identify systems containing or loading the rtl8723bs staging driver.
  • Apply the appropriate distributor kernel update containing the listed stable fix.
  • Confirm backport status with the Linux distributor because supplied version data is ambiguous.
  • Where updates are unavailable, follow vendor guidance and consider disabling affected Wi-Fi hardware.

Validation and detection

  • Record each system's kernel build and whether rtl8723bs is present or loaded.
  • Check distributor advisories and package changelogs for the applicable stable fix commit.
  • Verify the updated kernel is active after remediation.
  • Confirm rtl8723bs is absent or disabled where compensating controls were chosen.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68256 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2025-68256Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290b, 554c0a3abf216c991c5ebddcdb2c08689ecd290bunaffected
LinuxLinux4.12, 0, 5.15.203, 6.1.160, 6.6.120, 6.12.62, 6.17.12, 6.18.1, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.