CVE-2025-68256
- Source
- https://cve.org/CVERecord?id=CVE-2025-68256
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68256.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-68256
- Downstream
- Related
- Published
- 2025-12-16T14:44:58.829Z
- Modified
- 2026-03-31T17:30:03.217454584Z
- Summary
- staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix out-of-bounds read in rtwgetie() parser
The Information Element (IE) parser rtwgetie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop.
Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element.
This prevents OOB reads and ensures the parser terminates safely on malformed frames.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68256.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/154828bf9559b9c8421fc2f0d7f7f76b3683aaed
- https://git.kernel.org/stable/c/30c558447e90935f0de61be181bbcedf75952e00
- https://git.kernel.org/stable/c/a54e2b2db1b7de2e008b4f62eec35aaefcc663c5
- https://git.kernel.org/stable/c/b977eb31802817f4a37da95bf16bfdaa1eeb5fc2
- https://git.kernel.org/stable/c/c0d93d69e1472ba75b78898979b90a98ba2a2501
- https://git.kernel.org/stable/c/df191dd9f4c7249d98ada55634fa8ac19089b8cb
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68256.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-68256
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced554c0a3abf216c991c5ebddcdb2c08689ecd290bFixedb977eb31802817f4a37da95bf16bfdaa1eeb5fc2Fixed30c558447e90935f0de61be181bbcedf75952e00Fixeda54e2b2db1b7de2e008b4f62eec35aaefcc663c5Fixeddf191dd9f4c7249d98ada55634fa8ac19089b8cbFixedc0d93d69e1472ba75b78898979b90a98ba2a2501Fixed154828bf9559b9c8421fc2f0d7f7f76b3683aaed