CVE-2026-46305: Linux rtl8723bs NULL Pointer Dereference DoS Vulnerability

Technical summary

CVE-2026-46305 is a NULL pointer dereference vulnerability in the Linux kernel's rtl8723bs staging driver, specifically in the rtw_cbuf_alloc() function within os_dep. The kzalloc_flex() call used to allocate memory lacks proper validation of the return value. When allocation fails and returns NULL, subsequent code unconditionally dereferences the pointer without null-checking guards. This results in a kernel panic and denial of service. The vulnerability is classified as CWE-476 (NULL Pointer Dereference) with a CVSS v3.1 score of 5.5 (Medium severity, local attack vector, low complexity).

Business impact

The primary business impact is availability degradation rather than confidentiality or integrity loss. A system running a vulnerable kernel version with the rtl8723bs driver loaded could experience unexpected system crashes triggered by memory pressure or allocation failures. For organizations relying on Linux systems with this WiFi adapter, remediation prevents recurring kernel panics and improves system stability. The impact is limited to systems with this specific hardware adapter, narrowing the scope for most enterprise environments.

Affected systems

This vulnerability affects Linux kernel installations with the rtl8723bs WiFi driver enabled. The rtl8723bs driver is a staging driver used by systems with Realtek RTL8723BS chipset wireless adapters—commonly found in certain laptops, embedded systems, and USB WiFi dongles. Impact depends on kernel version and whether the driver is actively loaded; systems without this adapter are unaffected.

Exploitability

Exploitability is limited due to the local-only attack vector requirement. An attacker needs local system access and the ability to trigger memory pressure or allocation failures—for example, via resource exhaustion attacks or crafted workloads. The vulnerability cannot be remotely triggered across a network. Privilege escalation is not possible via this flaw; the impact is denial of service only. No public exploit code is known, and the vulnerability does not appear on the CISA KEV catalog.

Remediation

Apply the kernel patch addressing rtw_cbuf_alloc() to add proper NULL pointer checks after kzalloc_flex() calls. The fix guards buffer access with null-checking conditions before dereferencing. Verify the patched kernel version against your Linux distribution's advisory. For systems where the rtl8723bs driver is not needed, disabling or removing the driver eliminates exposure entirely.

Patch guidance

Consult your Linux distribution's kernel security advisories for patched versions. Most major distributions (Ubuntu, Debian, Red Hat, etc.) will backport fixes to their supported kernel branches. Verify patch availability at your vendor's advisory page, as version numbers vary by distribution. Systems running enterprise-supported kernels typically receive patches through standard update channels. Test patched kernels in a non-production environment first to confirm stability, particularly for driver-level changes.

Detection guidance

Monitor system logs and dmesg output for kernel panic messages related to rtl8723bs or NULL pointer dereference faults originating from the driver's buffer allocation code. Kernel crash dumps and syslog entries will contain stack traces pointing to rtw_cbuf_alloc(). On systems where the driver is active, track unexpected reboots or availability drops coinciding with memory pressure events. Use 'lsmod | grep rtl8723bs' to confirm whether the driver is currently loaded.

Why prioritize this

While the CVSS score of 5.5 is moderate, prioritization should account for your specific environment. If your organization uses Linux systems with RTL8723BS adapters, patching should occur within your standard maintenance window to prevent unplanned downtime from kernel panics. For most enterprise data center environments without this hardware, the practical risk is lower. However, container environments, embedded systems, or edge deployments using these adapters should prioritize patch deployment to ensure operational stability.

Risk score, explained

The CVSS v3.1 score of 5.5 reflects a local attack requirement (AV:L), low attack complexity (AC:L), and a need for low privileges (PR:L), resulting in high availability impact (A:H) but no confidentiality or integrity impact. The 'Medium' severity designation appropriately captures that while this is a serious stability issue, it requires local access and affects only a specific driver. The score does not account for the narrow scope of affected hardware, which in practice reduces organizational risk.

Frequently asked questions