CVE-2026-74651

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()<br /> <br /> rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific<br /> information element without checking that the element is long enough,<br /> causing an out-of-bounds read for a short trailing IE.<br /> <br /> The function locates a vendor-specific IE (EID 221) with rtw_get_ie()<br /> and then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte<br /> version word at pbuf + 6. Those accesses require the IE body to be at<br /> least 6 bytes, but rtw_get_ie() only guarantees that the element fits<br /> within the buffer; it does not enforce a minimum body length. A<br /> vendor-specific IE whose length byte is 0 to 5, placed at the end of<br /> the buffer, therefore makes these reads run past the end of the IE and<br /> past the end of the buffer itself.<br /> <br /> The buffer holds information elements taken from received management<br /> frames and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which<br /> is kmemdup&amp;#39;d to its exact length, so the read can run off the end of<br /> the allocation.<br /> <br /> The sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and<br /> rtw_get_wps_ie() in this file already reject too-short vendor-specific<br /> IEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in<br /> line with them, and needs a minimum of 6 rather than 4 bytes because<br /> of the version word. Add the missing length check.