High 8.8Published Dec 16, 2025

CVE-2025-68255staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

Updated under an hour ago (Oct 26, 2026, 2:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow. Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow. This prevents kernel stack corruption triggered by malformed association requests.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 49b7806851f93fd342838c93f4f765e0cc5029b0; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 4445adedae770037078803d1ce41f9e88a1944b6; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before d129dc2a5d59b4d9cd2cc0b6eeb04df8461199f0; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 34620eb602aa432f090b2b784ee5c5070fb16cf9; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 61871c83259a511980ec2664964cecc69005398b; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 25411f5fcf5743131158f337c99c2bbf3f8477f5; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before e841d8ea722315b781c4fc5bf4f7670fbca88875; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 6ef0e1c10455927867cac8f0ed6b49f328f8cf95	CNA record

References

References

https://git.kernel.org/stable/c/49b7806851f93fd342838c93f4f765e0cc5029b0
https://git.kernel.org/stable/c/4445adedae770037078803d1ce41f9e88a1944b6
https://git.kernel.org/stable/c/d129dc2a5d59b4d9cd2cc0b6eeb04df8461199f0
https://git.kernel.org/stable/c/34620eb602aa432f090b2b784ee5c5070fb16cf9
https://git.kernel.org/stable/c/61871c83259a511980ec2664964cecc69005398b
https://git.kernel.org/stable/c/25411f5fcf5743131158f337c99c2bbf3f8477f5
https://git.kernel.org/stable/c/e841d8ea722315b781c4fc5bf4f7670fbca88875
https://git.kernel.org/stable/c/6ef0e1c10455927867cac8f0ed6b49f328f8cf95

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.