Security readout for executives and security teams
Plain-English summary
A Linux Wi-Fi driver may use two bytes of uninitialized memory while verifying protected wireless management traffic. This can produce unpredictable verification behavior and potentially disrupt affected systems or weaken message integrity. Exposure requires the rtl8723bs staging driver and an adjacent network position; it is not described as remotely exploitable across the internet.
Executive priority
Prioritize affected wireless endpoints and embedded devices, especially where availability is operationally important. This is a high-severity adjacent-network issue, but the supplied evidence does not indicate active exploitation. Patch through normal expedited kernel maintenance after confirming that the vulnerable driver is present.
Technical view
In rtw_BIP_verify(), six bytes are copied into an eight-byte u64 variable, leaving two bytes uninitialized. Initializing le_tmp64 to zero makes verification deterministic. The supplied CVSS 3.1 score is 7.1, with adjacent-network access, low complexity, no privileges or user interaction, low integrity impact, high availability impact, and no confidentiality impact.
Likely exposure
Likely exposure is limited to Linux systems using the staging rtl8723bs wireless driver on an affected kernel build. Systems without this driver or compatible hardware are unlikely to be exposed. The supplied version data is ambiguous, so distribution-specific kernel package status should be confirmed with the relevant vendor.
Exploitation context
The CVSS vector requires adjacent-network access, meaning an attacker would generally need proximity or access to the same wireless environment. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public weaponization, or a proven exploitation path.
Researcher notes
The defect is an uninitialized-data use during BIP verification, identified by Smatch. The source bundle names no CWE and does not demonstrate exploitability beyond the CVSS assessment. Exact affected-version boundaries are unclear because the supplied list mixes releases and commit identifiers; validate against stable fixes and distribution backports.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Confirm the updated kernel is active after any required restart.
- Where patching is delayed, assess whether the rtl8723bs driver can be safely avoided.
- Monitor Linux and distribution vendor guidance for corrected package mappings.
Validation and detection
- Inventory systems loading or packaging the rtl8723bs staging driver.
- Record running kernel and distribution package versions on potentially affected systems.
- Compare each build with vendor advisories and the applicable stable kernel fix.
- After updating, verify the running kernel contains the initialization change.
- Confirm wireless functionality and protected management traffic remain operational.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31626 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H2.84.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6792624d933146e2757b07092e93ad915cb58930CVE reference, Linux
- https://git.kernel.org/stable/c/51532c7c1d357145f4ac561648499f7a6847f739CVE reference, Linux
- https://git.kernel.org/stable/c/9e911eead187240193516edf55a0e1ab3425aa5bCVE reference, Linux
- https://git.kernel.org/stable/c/c65ee4d3be5df395e48afbcd0946dd5fce4338a9CVE reference, Linux
- https://git.kernel.org/stable/c/d5b8f5f8d6fc09a8af5ed139c688660f578ed732CVE reference, Linux
- https://git.kernel.org/stable/c/b487a7754d874230299d5a9c2710ec4df8b2ed8aCVE reference, Linux
- https://git.kernel.org/stable/c/c2026c6b603ebec52f55015496703fe79077accfCVE reference, Linux
- https://git.kernel.org/stable/c/ef74ce5f0bc0e53ce702d8a794f3957884a26efcCVE reference, Linux
- https://git.kernel.org/stable/c/8c964b82a4e97ec7f25e17b803ee196009b38a57CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.