|
ELS
< Back

CVE-2026-74648

Updated on 22 Aug 2026

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: validate monitor transmit frame lengths

rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains.

The data path also pulls the calculated 802.11, QoS and SNAP header span before confirming that the skb contains it. A truncated frame can therefore cause out-of-bounds reads or leave insufficient data for the Ethernet address writes.

Reject frames that do not contain the base 802.11 header and data frames that do not contain their complete calculated header span.

Details

Affected product:
Debian 10 ELS , Debian 11 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
linux @ 4.19.0 (+4 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 12 Planned —
Debian 13 Released
15 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.94-1
  • 6.12.95-1
  • 6.12.96-1
  • 6.12.100-1
  • 6.12.101-1
Oracle Linux 9 UEK 7 Planned —