CVE-2026-23073

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23073
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Fix memory corruption due to not set vif driver data size The struct ieee80211_vif contains trailing space for vif driver data, when struct ieee80211_vif is allocated, the total memory size that is allocated is sizeof(struct ieee80211_vif) + size of vif driver data. The size of vif driver data is set by each WiFi driver as needed. The RSI911x driver does not set vif driver data size, no trailing space for vif driver data is therefore allocated past struct ieee80211_vif . The RSI911x driver does however use the vif driver data to store its vif driver data structure "struct vif_priv". An access to vif->drv_priv leads to access out of struct ieee80211_vif bounds and corruption of some memory. In case of the failure observed locally, rsi_mac80211_add_interface() would write struct vif_priv *vif_info = (struct vif_priv *)vif->drv_priv; vif_info->vap_id = vap_idx. This write corrupts struct fq_tin member struct list_head new_flows . The flow = list_first_entry(head, struct fq_flow, flowchain); in fq_tin_reset() then reports non-NULL bogus address, which when accessed causes a crash. The trigger is very simple, boot the machine with init=/bin/sh , mount devtmpfs, sysfs, procfs, and then do "ip link set wlan0 up", "sleep 1", "ip link set wlan0 down" and the crash occurs. Fix this by setting the correct size of vif driver data, which is the size of "struct vif_priv", so that memory is allocated and the driver can store its driver data in it, instead of corrupting memory around it.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0d7c9e793e351cbbe9e06a9ca47d77b6ad288fb0 Patch
https://git.kernel.org/stable/c/31efbcff90884ea5f65bf3d1de01267db51ee3d1 Patch
https://git.kernel.org/stable/c/49ef094fdbc3526e5db2aebb404b84f79c5603dc Patch
https://git.kernel.org/stable/c/4f431d88ea8093afc7ba55edf4652978c5a68f33 Patch
https://git.kernel.org/stable/c/7761d7801f40e61069b4df3db88b36d80d089f8a Patch
https://git.kernel.org/stable/c/7c54d0c3e2cad4300be721ec2aecfcf8a63bc9f4 Patch
https://git.kernel.org/stable/c/99129d80a5d4989ef8566f434f3589f60f28042b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

18 Mar 2026, 20:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: wifi: rsi: Corrección de corrupción de memoria debido a que no se estableció el tamaño de los datos del controlador vif La estructura ieee80211_vif contiene espacio adicional para los datos del controlador vif, cuando se asigna la estructura ieee80211_vif, el tamaño total de memoria que se asigna es sizeof(struct ieee80211_vif) + tamaño de los datos del controlador vif. El tamaño de los datos del controlador vif es establecido por cada controlador WiFi según sea necesario. El controlador RSI911x no establece el tamaño de los datos del controlador vif, por lo tanto, no se asigna espacio adicional para los datos del controlador vif más allá de la estructura ieee80211_vif. Sin embargo, el controlador RSI911x utiliza los datos del controlador vif para almacenar su estructura de datos del controlador vif 'struct vif_priv'. Un acceso a vif->drv_priv conduce a un acceso fuera de los límites de la estructura ieee80211_vif y a la corrupción de parte de la memoria. En caso de la falla observada localmente, rsi_mac80211_add_interface() escribiría struct vif_priv *vif_info = (struct vif_priv *)vif->drv_priv; vif_info->vap_id = vap_idx. Esta escritura corrompe el miembro de la estructura fq_tin struct list_head new_flows. El flow = list_first_entry(head, struct fq_flow, flowchain); en fq_tin_reset() luego reporta una dirección falsa no-NULL, que al ser accedida causa un fallo. El disparador es muy simple, arrancar la máquina con init=/bin/sh, montar devtmpfs, sysfs, procfs, y luego ejecutar 'ip link set wlan0 up', 'sleep 1', 'ip link set wlan0 down' y el fallo ocurre. Solucionar esto estableciendo el tamaño correcto de los datos del controlador vif, que es el tamaño de 'struct vif_priv', para que se asigne memoria y el controlador pueda almacenar sus datos de controlador en ella, en lugar de corromper la memoria a su alrededor.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-787
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/0d7c9e793e351cbbe9e06a9ca47d77b6ad288fb0 - () https://git.kernel.org/stable/c/0d7c9e793e351cbbe9e06a9ca47d77b6ad288fb0 - Patch
References () https://git.kernel.org/stable/c/31efbcff90884ea5f65bf3d1de01267db51ee3d1 - () https://git.kernel.org/stable/c/31efbcff90884ea5f65bf3d1de01267db51ee3d1 - Patch
References () https://git.kernel.org/stable/c/49ef094fdbc3526e5db2aebb404b84f79c5603dc - () https://git.kernel.org/stable/c/49ef094fdbc3526e5db2aebb404b84f79c5603dc - Patch
References () https://git.kernel.org/stable/c/4f431d88ea8093afc7ba55edf4652978c5a68f33 - () https://git.kernel.org/stable/c/4f431d88ea8093afc7ba55edf4652978c5a68f33 - Patch
References () https://git.kernel.org/stable/c/7761d7801f40e61069b4df3db88b36d80d089f8a - () https://git.kernel.org/stable/c/7761d7801f40e61069b4df3db88b36d80d089f8a - Patch
References () https://git.kernel.org/stable/c/7c54d0c3e2cad4300be721ec2aecfcf8a63bc9f4 - () https://git.kernel.org/stable/c/7c54d0c3e2cad4300be721ec2aecfcf8a63bc9f4 - Patch
References () https://git.kernel.org/stable/c/99129d80a5d4989ef8566f434f3589f60f28042b - () https://git.kernel.org/stable/c/99129d80a5d4989ef8566f434f3589f60f28042b - Patch

06 Feb 2026, 17:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0d7c9e793e351cbbe9e06a9ca47d77b6ad288fb0 -
  • () https://git.kernel.org/stable/c/49ef094fdbc3526e5db2aebb404b84f79c5603dc -
  • () https://git.kernel.org/stable/c/7c54d0c3e2cad4300be721ec2aecfcf8a63bc9f4 -

04 Feb 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 17:16

Updated : 2026-03-18 20:13

NVD link : CVE-2026-23073

Mitre link : CVE-2026-23073

CVE.ORG link : CVE-2026-23073

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write