CVE-2025-68256

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop. Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element. This prevents OOB reads and ensures the parser terminates safely on malformed frames.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/154828bf9559b9c8421fc2f0d7f7f76b3683aaed
https://git.kernel.org/stable/c/30c558447e90935f0de61be181bbcedf75952e00
https://git.kernel.org/stable/c/9829c6e1b2e4180fd18315252ad6faeab6128076
https://git.kernel.org/stable/c/a54e2b2db1b7de2e008b4f62eec35aaefcc663c5
https://git.kernel.org/stable/c/b977eb31802817f4a37da95bf16bfdaa1eeb5fc2
https://git.kernel.org/stable/c/c0d93d69e1472ba75b78898979b90a98ba2a2501
https://git.kernel.org/stable/c/df191dd9f4c7249d98ada55634fa8ac19089b8cb

Configurations

No configuration.

History

30 Jul 2026, 06:24

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8

18 Apr 2026, 09:16

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/9829c6e1b2e4180fd18315252ad6faeab6128076 -

11 Jan 2026, 17:15

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/30c558447e90935f0de61be181bbcedf75952e00 - () https://git.kernel.org/stable/c/b977eb31802817f4a37da95bf16bfdaa1eeb5fc2 -

16 Dec 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-16 15:15

Updated : 2026-07-30 06:24

NVD link : CVE-2025-68256

Mitre link : CVE-2025-68256

CVE.ORG link : CVE-2025-68256

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-68256", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "9829c6e1b2e4180fd18315252ad6faeab6128076", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "b977eb31802817f4a37da95bf16bfdaa1eeb5fc2", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "30c558447e90935f0de61be181bbcedf75952e00", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "a54e2b2db1b7de2e008b4f62eec35aaefcc663c5", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "df191dd9f4c7249d98ada55634fa8ac19089b8cb", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "c0d93d69e1472ba75b78898979b90a98ba2a2501", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "154828bf9559b9c8421fc2f0d7f7f76b3683aaed", "versionType": "git"}], "programFiles": ["drivers/staging/rtl8723bs/core/rtw_ieee80211.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"status": "unaffected", "version": "0", "lessThan": "4.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.160", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.120", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.62", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.12", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18.1", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/staging/rtl8723bs/core/rtw_ieee80211.c"], "defaultStatus": "affected"}]}], "published": "2025-12-16T15:15:54.990", "references": [{"url": "https://git.kernel.org/stable/c/154828bf9559b9c8421fc2f0d7f7f76b3683aaed", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/30c558447e90935f0de61be181bbcedf75952e00", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9829c6e1b2e4180fd18315252ad6faeab6128076", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a54e2b2db1b7de2e008b4f62eec35aaefcc663c5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b977eb31802817f4a37da95bf16bfdaa1eeb5fc2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c0d93d69e1472ba75b78898979b90a98ba2a2501", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/df191dd9f4c7249d98ada55634fa8ac19089b8cb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser\n\nThe Information Element (IE) parser rtw_get_ie() trusted the length\nbyte of each IE without validating that the IE body (len bytes after\nthe 2-byte header) fits inside the remaining frame buffer. A malformed\nframe can advertise an IE length larger than the available data, causing\nthe parser to increment its pointer beyond the buffer end. This results\nin out-of-bounds reads or, depending on the pattern, an infinite loop.\n\nFix by validating that (offset + 2 + len) does not exceed the limit\nbefore accepting the IE or advancing to the next element.\n\nThis prevents OOB reads and ensures the parser terminates safely on\nmalformed frames."}], "lastModified": "2026-07-30T06:24:35.190", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}