CVE-2026-74650

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: rtl8723bs: fix OOB read in WMM_param_handler()<br /> <br /> WMM_param_handler() copies a fixed-size WMM parameter element out of a<br /> received information element without checking that the element is long<br /> enough, causing an out-of-bounds read for a short WMM IE.<br /> <br /> The handler reads sizeof(struct WMM_para_element) (18) bytes at<br /> pIE-&gt;data + 6, so it requires pIE-&gt;length to be at least 24<br /> (WLAN_WMM_LEN), but it never validates the length. Two of its three<br /> callers reach it after matching only the WMM OUI: OnAssocRsp() in<br /> rtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a<br /> 4-byte OUI, before calling the handler. A vendor-specific IE carrying<br /> the WMM OUI but a length between 6 and 23, placed in an association<br /> response or in the IE blob handed to join_cmd_hdl(), passes the OUI<br /> check and then makes the memcmp() and memcpy() at pIE-&gt;data + 6 read<br /> past the end of the element. OnAssocRsp() parses a frame received from<br /> the AP, so this is reachable from a remote peer.<br /> <br /> The remaining caller in rtw_wlan_util.c already guards the handler with<br /> "pIE-&gt;length == WLAN_WMM_LEN". Move the equivalent check into the<br /> handler itself so every caller is covered; the sibling IE handlers in<br /> the same parsing loop (HT_caps_handler(), HT_info_handler(),<br /> ERP_IE_handler()) likewise bound their accesses by pIE-&gt;length.