---
id: CVE-2026-68190
title: 'staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

  rtw_get_wps_ie() iterates over IE data from network frames without
  validating that the IE header and payload fit …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    c670efe69ec8a3360bfa596436f0250a3bf15d42
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    23b630e334f7e8f76bb22a18aca350da995af905
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    b9d9a4cd2e59df7281992a076464d2536e80c674
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    630fdca3f2437fee3ffd437c4b646ccf84c7be87
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    875479f18835ac11e21a83e88f3d4dc7ccdcd0c4
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    23c31f107b4f8f420a754a45d12599bdb78f9bb8
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    0e95ff792ae0aa6fbad9455943e9e1e4062670e9
  - Linux 4.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:44:18.275902Z'
published: '2026-08-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:45:01.404Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68190'
references:
  - url: 'https://git.kernel.org/stable/c/c670efe69ec8a3360bfa596436f0250a3bf15d42'
  - url: 'https://git.kernel.org/stable/c/23b630e334f7e8f76bb22a18aca350da995af905'
  - url: 'https://git.kernel.org/stable/c/b9d9a4cd2e59df7281992a076464d2536e80c674'
  - url: 'https://git.kernel.org/stable/c/630fdca3f2437fee3ffd437c4b646ccf84c7be87'
  - url: 'https://git.kernel.org/stable/c/875479f18835ac11e21a83e88f3d4dc7ccdcd0c4'
  - url: 'https://git.kernel.org/stable/c/23c31f107b4f8f420a754a45d12599bdb78f9bb8'
  - url: 'https://git.kernel.org/stable/c/0e95ff792ae0aa6fbad9455943e9e1e4062670e9'
tags:
  - cve.org
epss: 0.00211
epssPercentile: 0.1144
ingestedAt: '2026-11-06T16:57:43.135Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

rtw_get_wps_ie() iterates over IE data from network frames without
validating that the IE header and payload fit within the remaining
buffer before reading them. Specifically:

- in_ie[cnt + 1] is read without checking cnt + 1 < in_len
- memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check
- in_ie[cnt + 1] is used as length without verifying payload fits

Add bounds checks at the top of the loop body to break early if fewer
than 2 bytes remain for the IE header, or if the declared payload
extends past the end of the buffer. Also require at least 4 bytes of
payload before comparing the WPS OUI.

## Affected

- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < c670efe69ec8a3360bfa596436f0250a3bf15d42`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 23b630e334f7e8f76bb22a18aca350da995af905`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < b9d9a4cd2e59df7281992a076464d2536e80c674`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 630fdca3f2437fee3ffd437c4b646ccf84c7be87`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 875479f18835ac11e21a83e88f3d4dc7ccdcd0c4`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 23c31f107b4f8f420a754a45d12599bdb78f9bb8`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 0e95ff792ae0aa6fbad9455943e9e1e4062670e9`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.