{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-90017",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-90017"
  ],
  "published": "2026-09-16T10:32:03Z",
  "summary": "staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in rtw_action_frame_parse()\n\nrtw_action_frame_parse() takes a frame_len parameter but never\nactually checks it before indexing into the frame body:\n\n\tconst u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);\n\t...\n\tc = frame_body[0];\n\t...\n\ta = frame_body[1];\n\nframe_body already points 24 bytes (sizeof(struct\nieee80211_hdr_3addr)) into frame, so reading frame_body[0] and\nframe_body[1] requires frame_len >= 26. A management action frame\nshorter than that (e.g. exactly 24 bytes, the minimum a malicious\npeer can send) causes a 1-2 byte out-of-bounds read.\n\nThis is reachable from rtw_cfg80211_monitor_if_xmit_entry() and\ncfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass\nattacker/user-influenced frame buffers and lengths straight through.\n\nAdd the missing length check before frame_body is dereferenced.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90017"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/15081ff835b29e456da29303b32efc436df04695"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/310aaa8058d19cc431aedac0f5bb814e84479393"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1410bce22351ba15d8e58287cbf09d55d7f21fc9"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0b7f64c7bb9664777168768c6b44affb07dcbf24"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/136f9a3ab87ded8aaf081425cfb2059659dd9023"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b041e3f35e0d262d42a711094ab594634d72744a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a54fd1a44862d263df9f8bc17fca3620be31addb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ff917923f4fb9c83717ba135ee47d7e4c1567bb7"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-16T14:40:32Z"
  }
}