CVE-2026-68190 staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

Q: Is CVE-2026-68190 being exploited?

There is no known exploitation of CVE-2026-68190 in the wild and no public exploit code.

Not scored Published 10 Aug 2026 Updated 19 Aug 2026

An attacker within Wi-Fi range can trigger out-of-bounds reads in the rtl8723bs driver, potentially causing a system crash or leaking kernel memory.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-68190?

CVE-2026-68190 is a memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically:

- in_ie[cnt + 1] is read without checking cnt + 1 < in_len - memcmp(&in_ie[cnt + 2], ...) accesses cnt + 2 without bounds check - in_ie[cnt + 1] is used as length without verifying payload fits

Add bounds checks at the top of the loop body to break early if fewer than 2 bytes remain for the IE header, or if the declared payload extends past the end of the buffer. Also require at least 4 bytes of payload before comparing the WPS OUI.

Which versions are affected by CVE-2026-68190?

How do I fix CVE-2026-68190?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-68190 being exploited?