CVE-2025-68255

staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

State: Published
Severity: 8.8 High
Published: Dec 16, 2025
Updated: Aug 5, 2026
Reserved: Dec 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow.

Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow.

This prevents kernel stack corruption triggered by malformed association requests.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 49b7806851f93fd342838c93f4f765e0cc5029b0Affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 4445adedae770037078803d1ce41f9e88a1944b6Affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before d129dc2a5d59b4d9cd2cc0b6eeb04df8461199f0Affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 34620eb602aa432f090b2b784ee5c5070fb16cf9Affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 61871c83259a511980ec2664964cecc69005398bAffected 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 25411f5fcf5743131158f337c99c2bbf3f8477f5Affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before e841d8ea722315b781c4fc5bf4f7670fbca88875Affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 6ef0e1c10455927867cac8f0ed6b49f328f8cf95Affected
LinuxLinux	4.12Affected before 4.12Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.62 through 6.12.Not affected 6.17.12 through 6.17.Not affected 6.18.1 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 49b7806851f93fd342838c93f4f765e0cc5029b0Affected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 4445adedae770037078803d1ce41f9e88a1944b6Affected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to before d129dc2a5d59b4d9cd2cc0b6eeb04df8461199f0Affected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 34620eb602aa432f090b2b784ee5c5070fb16cf9Affected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 61871c83259a511980ec2664964cecc69005398bAffected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 25411f5fcf5743131158f337c99c2bbf3f8477f5Affected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to before e841d8ea722315b781c4fc5bf4f7670fbca88875Affected
554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 6ef0e1c10455927867cac8f0ed6b49f328f8cf95Affected

LinuxLinux

4.12Affected
before 4.12Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.62 through 6.12.*Not affected
6.17.12 through 6.17.*Not affected
6.18.1 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.