CVE-2025-68256

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser<br /> <br /> The Information Element (IE) parser rtw_get_ie() trusted the length<br /> byte of each IE without validating that the IE body (len bytes after<br /> the 2-byte header) fits inside the remaining frame buffer. A malformed<br /> frame can advertise an IE length larger than the available data, causing<br /> the parser to increment its pointer beyond the buffer end. This results<br /> in out-of-bounds reads or, depending on the pattern, an infinite loop.<br /> <br /> Fix by validating that (offset + 2 + len) does not exceed the limit<br /> before accepting the IE or advancing to the next element.<br /> <br /> This prevents OOB reads and ensures the parser terminates safely on<br /> malformed frames.