CVE-2025-68256

Vulnerability

Description CVE-2025-68256 is an out-of-bounds read vulnerability in the Linux kernel's staging driver rtl8723bs, specifically within the Information Element (IE) parser function rtw_get_ie(). The root cause is that the parser trusts the length byte of each IE without validating that the IE body (specified by that length) fits within the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to read beyond the allocated buffer.

Exploitation

An attacker with the ability to send crafted Wi-Fi management frames to a device using this driver can trigger the vulnerability. No authentication is required beyond proximity to the target. By manipulating the IE length field in a frame, the attacker forces the parser to increment its pointer past the buffer boundary, leading to out-of-bounds reads. Under certain conditions, the malformed data can cause an infinite loop in the parser, denying service.

Impact

Successful exploitation could result in information disclosure through out-of-bounds reads of kernel memory, or a denial-of-service condition via an infinite loop. The vulnerability is local to the kernel driver but can be triggered remotely by a nearby attacker sending a single crafted frame. The impact is limited to systems with the rtl8723bs driver loaded and an active Wi-Fi interface.

Mitigation

The Linux kernel has released fixes that add a bounds check: the parser now verifies that offset + 2 + len does not exceed the limit before processing the IE [1][2][3]. Users should update their kernel to a version containing the fix. There are no known workarounds, as the driver is part of the kernel and cannot be easily disabled without losing Wi-Fi functionality on affected hardware.