CVE-2026-74650

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74650", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.923Z", "datePublished": "2026-08-22T15:32:26.333Z", "dateUpdated": "2026-11-06T17:05:49.687Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:39:54.006Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in WMM_param_handler()\n\nWMM_param_handler() copies a fixed-size WMM parameter element out of a\nreceived information element without checking that the element is long\nenough, causing an out-of-bounds read for a short WMM IE.\n\nThe handler reads sizeof(struct WMM_para_element) (18) bytes at\npIE->data + 6, so it requires pIE->length to be at least 24\n(WLAN_WMM_LEN), but it never validates the length. Two of its three\ncallers reach it after matching only the WMM OUI: OnAssocRsp() in\nrtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a\n4-byte OUI, before calling the handler. A vendor-specific IE carrying\nthe WMM OUI but a length between 6 and 23, placed in an association\nresponse or in the IE blob handed to join_cmd_hdl(), passes the OUI\ncheck and then makes the memcmp() and memcpy() at pIE->data + 6 read\npast the end of the element. OnAssocRsp() parses a frame received from\nthe AP, so this is reachable from a remote peer.\n\nThe remaining caller in rtw_wlan_util.c already guards the handler with\n\"pIE->length == WLAN_WMM_LEN\". Move the equivalent check into the\nhandler itself so every caller is covered; the sibling IE handlers in\nthe same parsing loop (HT_caps_handler(), HT_info_handler(),\nERP_IE_handler()) likewise bound their accesses by pIE->length."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"], "versions": [{"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "5df2fd06567df5f178c8faae0bdaefd203618d21", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "2bee6f7a0f0125238951e31da2e96d06fe359043", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "1158b9931207392d6dd136aa0c4be18893b50fa1", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "ce2399717de242344880044b91a20a712644fdfb", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "e5b7610008f4e6a80c8b071aa77ddbd5e17ea472", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4", "status": "affected", "versionType": "git"}, {"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "ae21407350151bddfd4fea7aa39bd0643c0ca9d3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.267", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.10.267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5df2fd06567df5f178c8faae0bdaefd203618d21"}, {"url": "https://git.kernel.org/stable/c/6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93"}, {"url": "https://git.kernel.org/stable/c/2bee6f7a0f0125238951e31da2e96d06fe359043"}, {"url": "https://git.kernel.org/stable/c/1158b9931207392d6dd136aa0c4be18893b50fa1"}, {"url": "https://git.kernel.org/stable/c/ce2399717de242344880044b91a20a712644fdfb"}, {"url": "https://git.kernel.org/stable/c/e5b7610008f4e6a80c8b071aa77ddbd5e17ea472"}, {"url": "https://git.kernel.org/stable/c/e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4"}, {"url": "https://git.kernel.org/stable/c/ae21407350151bddfd4fea7aa39bd0643c0ca9d3"}], "title": "staging: rtl8723bs: fix OOB read in WMM_param_handler()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74650", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:00:21.541441Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:05:49.687Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74650", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:00:21.541441Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:00:22.565Z"}}], "cna": {"title": "staging: rtl8723bs: fix OOB read in WMM_param_handler()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "5df2fd06567df5f178c8faae0bdaefd203618d21", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "2bee6f7a0f0125238951e31da2e96d06fe359043", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "1158b9931207392d6dd136aa0c4be18893b50fa1", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "ce2399717de242344880044b91a20a712644fdfb", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "e5b7610008f4e6a80c8b071aa77ddbd5e17ea472", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4", "versionType": "git"}, {"status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "lessThan": "ae21407350151bddfd4fea7aa39bd0643c0ca9d3", "versionType": "git"}], "programFiles": ["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"status": "unaffected", "version": "0", "lessThan": "4.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.267", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5df2fd06567df5f178c8faae0bdaefd203618d21"}, {"url": "https://git.kernel.org/stable/c/6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93"}, {"url": "https://git.kernel.org/stable/c/2bee6f7a0f0125238951e31da2e96d06fe359043"}, {"url": "https://git.kernel.org/stable/c/1158b9931207392d6dd136aa0c4be18893b50fa1"}, {"url": "https://git.kernel.org/stable/c/ce2399717de242344880044b91a20a712644fdfb"}, {"url": "https://git.kernel.org/stable/c/e5b7610008f4e6a80c8b071aa77ddbd5e17ea472"}, {"url": "https://git.kernel.org/stable/c/e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4"}, {"url": "https://git.kernel.org/stable/c/ae21407350151bddfd4fea7aa39bd0643c0ca9d3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in WMM_param_handler()\n\nWMM_param_handler() copies a fixed-size WMM parameter element out of a\nreceived information element without checking that the element is long\nenough, causing an out-of-bounds read for a short WMM IE.\n\nThe handler reads sizeof(struct WMM_para_element) (18) bytes at\npIE->data + 6, so it requires pIE->length to be at least 24\n(WLAN_WMM_LEN), but it never validates the length. Two of its three\ncallers reach it after matching only the WMM OUI: OnAssocRsp() in\nrtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a\n4-byte OUI, before calling the handler. A vendor-specific IE carrying\nthe WMM OUI but a length between 6 and 23, placed in an association\nresponse or in the IE blob handed to join_cmd_hdl(), passes the OUI\ncheck and then makes the memcmp() and memcpy() at pIE->data + 6 read\npast the end of the element. OnAssocRsp() parses a frame received from\nthe AP, so this is reachable from a remote peer.\n\nThe remaining caller in rtw_wlan_util.c already guards the handler with\n\"pIE->length == WLAN_WMM_LEN\". Move the equivalent check into the\nhandler itself so every caller is covered; the sibling IE handlers in\nthe same parsing loop (HT_caps_handler(), HT_info_handler(),\nERP_IE_handler()) likewise bound their accesses by pIE->length."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.267", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:39:54.006Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74650", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:05:49.687Z", "dateReserved": "2026-08-15T05:44:03.923Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:26.333Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5df2fd06567df5f178c8faae0bdaefd203618d21", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "2bee6f7a0f0125238951e31da2e96d06fe359043", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "1158b9931207392d6dd136aa0c4be18893b50fa1", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "ce2399717de242344880044b91a20a712644fdfb", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "e5b7610008f4e6a80c8b071aa77ddbd5e17ea472", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}, {"lessThan": "ae21407350151bddfd4fea7aa39bd0643c0ca9d3", "status": "affected", "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/staging/rtl8723bs/core/rtw_wlan_util.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.267", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in WMM_param_handler()\n\nWMM_param_handler() copies a fixed-size WMM parameter element out of a\nreceived information element without checking that the element is long\nenough, causing an out-of-bounds read for a short WMM IE.\n\nThe handler reads sizeof(struct WMM_para_element) (18) bytes at\npIE->data + 6, so it requires pIE->length to be at least 24\n(WLAN_WMM_LEN), but it never validates the length. Two of its three\ncallers reach it after matching only the WMM OUI: OnAssocRsp() in\nrtw_mlme_ext.c matches a 6-byte OUI, and join_cmd_hdl() matches a\n4-byte OUI, before calling the handler. A vendor-specific IE carrying\nthe WMM OUI but a length between 6 and 23, placed in an association\nresponse or in the IE blob handed to join_cmd_hdl(), passes the OUI\ncheck and then makes the memcmp() and memcpy() at pIE->data + 6 read\npast the end of the element. OnAssocRsp() parses a frame received from\nthe AP, so this is reachable from a remote peer.\n\nThe remaining caller in rtw_wlan_util.c already guards the handler with\n\"pIE->length == WLAN_WMM_LEN\". Move the equivalent check into the\nhandler itself so every caller is covered; the sibling IE handlers in\nthe same parsing loop (HT_caps_handler(), HT_info_handler(),\nERP_IE_handler()) likewise bound their accesses by pIE->length."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nstaging: rtl8723bs: correcci\u00f3n de lectura fuera de l\u00edmites en WMM_param_handler()\n\nWMM_param_handler() copia un elemento de par\u00e1metro WMM de tama\u00f1o fijo de un elemento de informaci\u00f3n recibido sin verificar que el elemento sea lo suficientemente largo, causando una lectura fuera de l\u00edmites para un IE WMM corto.\n\nEl gestor lee sizeof(struct WMM_para_element) (18) bytes en pIE -> data + 6, por lo que requiere que pIE -> length sea al menos 24 (WLAN_WMM_LEN), pero nunca valida la longitud. Dos de sus tres llamadores lo alcanzan despu\u00e9s de coincidir solo con el OUI WMM: OnAssocRsp() en rtw_mlme_ext.c coincide con un OUI de 6 bytes, y join_cmd_hdl() coincide con un OUI de 4 bytes, antes de llamar al gestor. Un IE espec\u00edfico del proveedor que lleva el OUI WMM pero una longitud entre 6 y 23, colocado en una respuesta de asociaci\u00f3n o en el blob de IE entregado a join_cmd_hdl(), pasa la verificaci\u00f3n del OUI y luego hace que memcmp() y memcpy() en pIE -> data + 6 lean m\u00e1s all\u00e1 del final del elemento. OnAssocRsp() analiza una trama recibida del AP, por lo que esto es alcanzable desde un par remoto.\n\nEl llamador restante en rtw_wlan_util.c ya protege al gestor con 'pIE -> length == WLAN_WMM_LEN'. Mover la verificaci\u00f3n equivalente al propio gestor para que cada llamador est\u00e9 cubierto; los gestores de IE hermanos en el mismo bucle de an\u00e1lisis (HT_caps_handler(), HT_info_handler(), ERP_IE_handler()) de manera similar limitan sus accesos por pIE -> length."}], "id": "CVE-2026-74650", "lastModified": "2026-11-06T17:19:52.373", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74650", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:00:21.541441Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:38.413", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1158b9931207392d6dd136aa0c4be18893b50fa1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2bee6f7a0f0125238951e31da2e96d06fe359043"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5df2fd06567df5f178c8faae0bdaefd203618d21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae21407350151bddfd4fea7aa39bd0643c0ca9d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce2399717de242344880044b91a20a712644fdfb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5b7610008f4e6a80c8b071aa77ddbd5e17ea472"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: staging: rtl8723bs: fix OOB read in WMM_param_handler()", "id": "2521385", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521385"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's Wi-Fi driver (`rtl8723bs`). This vulnerability occurs because the system does not properly check the size of incoming Wireless Multimedia (WMM) information elements. A remote attacker could exploit this by sending a specially crafted network message, leading to an out-of-bounds read. This could potentially expose sensitive information or cause the system to become unstable."], "name": "CVE-2026-74650", "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74650\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74650\nhttps://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74650-516c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[554c0a3abf216c991c5ebddcdb2c08689ecd290b,6cdca4c8b64c15a3ab9ad7a85f482e9519eadf93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[554c0a3abf216c991c5ebddcdb2c08689ecd290b,2bee6f7a0f0125238951e31da2e96d06fe359043)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[554c0a3abf216c991c5ebddcdb2c08689ecd290b,1158b9931207392d6dd136aa0c4be18893b50fa1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[554c0a3abf216c991c5ebddcdb2c08689ecd290b,ce2399717de242344880044b91a20a712644fdfb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[554c0a3abf216c991c5ebddcdb2c08689ecd290b,e5b7610008f4e6a80c8b071aa77ddbd5e17ea472)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[554c0a3abf216c991c5ebddcdb2c08689ecd290b,e429c6dfd5d2324cd866daaf4c29d5cfe4dea0e4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[554c0a3abf216c991c5ebddcdb2c08689ecd290b,ae21407350151bddfd4fea7aa39bd0643c0ca9d3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T17:15:04.453360+00:00", "updated": "2026-08-24T20:15:04.188632+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}