CVE-2025-68254

Vulnerability

In the Linux kernel's staging driver rtl8723bs, the OnBeacon function parses Extended Supported Rates (ESR) Information Elements from received beacon frames. The code accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets remain within the bounds of the received frame buffer. A malformed beacon with an ESR IE positioned at the end of the buffer could trigger an out-of-bounds read, potentially leading to a kernel panic [1][2][3].

Exploitation

An attacker within Wi-Fi range can send a specially crafted beacon frame to a device using the rtl8723bs driver. No authentication is required because beacon frames are broadcast and processed before any association. The attacker only needs to control the beacon's Information Element layout to place the ESR IE such that its body extends beyond the actual frame length.

Impact

Successful exploitation causes an out-of-bounds read, which may result in a kernel panic (denial of service). The read accesses memory beyond the frame buffer, potentially exposing sensitive kernel memory or causing instability. The vulnerability does not appear to allow arbitrary code execution based on the description.

Mitigation

The fix adds a boundary check to ensure the ESR IE body and subsequent bytes are within the frame limits before accessing them [1][2][3]. The patch has been applied to the Linux kernel stable tree. Users should update to a kernel version containing the commit to eliminate the vulnerability.