https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:05:26 +0000 https://vulnerability.circl.lu/vuln/cve-2025-68256 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser</p> <p>The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop.</p> <p>Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element.</p> <p>This prevents OOB reads and ensures the parser terminates safely on malformed frames.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser</p> <p>The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop.</p> <p>Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element.</p> <p>This prevents OOB reads and ensures the parser terminates safely on malformed frames.</p> https://vulnerability.circl.lu/vuln/cve-2025-68256