CVE-2026-53179: Linux Kernel RTL8723BS Buffer Over-Read – Information Disclosure Vulnerability

Technical summary

CVE-2026-53179 is a CWE-125 out-of-bounds read vulnerability in the Linux kernel's staging/rtl8723bs driver. The rtw_update_protection() function receives both an offset pointer into the information element (IE) buffer and the full ie_length value. Because the length parameter reflects the entire buffer size rather than the remaining bytes from the offset point, the function can read past the intended buffer boundary. This is a classic off-by-one or pointer arithmetic error that allows kernel memory disclosure. The vulnerability requires local code execution privileges to exploit and does not directly enable code execution on its own.

Business impact

For organizations running Linux systems with the affected RTL8723BS wireless driver loaded (commonly found in certain laptops and embedded devices), this vulnerability enables a local attacker to read sensitive kernel memory. In multi-tenant or shared-access environments, this could leak cryptographic keys, process credentials, or other protected data resident in kernel space. The impact is primarily confidentiality-focused, though combined with other kernel vulnerabilities it could escalate privilege escalation attacks. Most high-security deployments should treat any kernel information disclosure as a material risk.

Affected systems

The Linux kernel is affected across multiple versions that include the vulnerable staging/rtl8723bs driver code. The RTL8723BS is a wireless chipset driver, typically found in consumer and prosumer laptops, IoT devices, and some embedded systems using Realtek wireless adapters. Systems where this driver is loaded into kernel memory are vulnerable; those without RTL8723BS hardware or with the driver disabled are not impacted. Verify your kernel version and driver presence using 'lsmod | grep rtl8723bs'.

Exploitability

Exploitability requires local access and standard user privileges (not root). An authenticated local attacker can trigger the vulnerable code path through wireless driver operations or device interactions that invoke rtw_update_protection(). There is no remote attack vector. The CVSS score of 7.1 (HIGH) reflects the high confidentiality impact and relatively low exploitation barrier once local access is established. The vulnerability is not known to be publicly weaponized or included in the Known Exploited Vulnerabilities catalog.

Remediation

Apply a patched Linux kernel version that includes the fix to rtw_update_protection(). The patch corrects the pointer arithmetic by passing only the remaining buffer length rather than the full ie_length. Verify the exact patch version against your Linux distribution's security advisories and kernel repositories. If immediate patching is not feasible, consider disabling the RTL8723BS driver if the wireless chipset is not in use, or restricting local system access to trusted users only.

Patch guidance

Consult your Linux distribution's security advisory (Red Hat, Canonical, SUSE, etc.) for the specific patched kernel version available for your release. The upstream Linux kernel fix modifies rtw_update_protection() to correctly calculate the buffer boundary. Test patches in a non-production environment before deployment. Distributions may backport the fix to stable kernel branches, so check release notes carefully. Reboot is required after kernel update.

Detection guidance

Monitor kernel logs for any warnings or errors related to the rtl8723bs driver. Use kernel address sanitizer (KASAN) or similar runtime detection in test environments to identify buffer over-reads. On production systems, audit which local users have network configuration or device access privileges, as these are most likely to trigger the vulnerable code path. Check '/sys/module/rtl8723bs' to confirm driver is loaded. Watch for any unexpected memory access patterns or information disclosure attempts correlated with wireless driver activity.

Why prioritize this

Prioritize this vulnerability for systems that load the RTL8723BS driver and allow untrusted or semi-trusted local users. Organizations with strong local access controls (single-user systems, locked-down servers) face lower immediate risk but should still patch to close the information disclosure vector. Kernel memory disclosure is a foundational building block for advanced privilege escalation chains, making this HIGH severity despite the local-only requirement. The lack of KEV listing suggests limited real-world exploitation to date, but that should not delay patching.

Risk score, explained

The CVSS 3.1 score of 7.1 is driven by: (1) Attack Vector: Local (reduces from network), (2) Access Complexity: Low (standard user can trigger), (3) Privileges Required: Low (no root needed), (4) User Interaction: None (automatic on function call), (5) Confidentiality Impact: High (kernel memory disclosure), (6) Integrity: None (read-only), (7) Availability: High (potential denial if memory is corrupted or causes crash). The 'High' Availability impact likely reflects the potential for kernel instability or crash if the over-read touches unmapped memory. This makes it a significant insider-threat or multi-user-system risk.

Frequently asked questions