Medium [CVE-2026-68190] Out-of-bounds read in rtl8723bs driver can lead to information disclosure

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them.

Specifically: - in_ie[cnt + 1] is read without checking cnt + 1 < in_len - memcmp(&in_ie[cnt + 2],...) accesses cnt + 2 without bounds check - in_ie[cnt + 1] is used as length without verifying payload fits Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer.

Also require at least 4 bytes of payload before comparing the WPS OUI. The `rtw_get_wps_ie()` function, responsible for processing network frame data, fails to properly validate the size of incoming information elements (IEs).

This oversight allows an attacker to trigger an out-of-bounds read, potentially leading to the disclosure of sensitive information or system instability. The vulnerability occurs when the driver attempts to read beyond the allocated buffer due to malformed IE data.

Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-125.

Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.