CVE-2025-68255staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
- 8.8HighCVSS base score
- 0.37%Exploitation in 30 daysEPSS · top 69% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow. Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow. This prevents kernel stack corruption triggered by malformed association requests.
Timeline
ID reserved
By Linux
Published
- 8 months later
· 8 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.37% · top 69% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b – < 49b7806851f93fd342838c93f4f765e0cc5029b0
- affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b – < 4445adedae770037078803d1ce41f9e88a1944b6
- affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b – < d129dc2a5d59b4d9cd2cc0b6eeb04df8461199f0
- affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b – < 34620eb602aa432f090b2b784ee5c5070fb16cf9
- affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b – < 61871c83259a511980ec2664964cecc69005398b
- affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b – < 25411f5fcf5743131158f337c99c2bbf3f8477f5
- affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b – < e841d8ea722315b781c4fc5bf4f7670fbca88875
- affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b – < 6ef0e1c10455927867cac8f0ed6b49f328f8cf95
- affected 4.12
- unaffected < 4.12
- unaffected 5.10.248 – ≤ 5.10.*
- unaffected 5.15.198 – ≤ 5.15.*
- unaffected 6.1.160 – ≤ 6.1.*
- unaffected 6.6.120 – ≤ 6.6.*
- unaffected 6.12.62 – ≤ 6.12.*
- unaffected 6.17.12 – ≤ 6.17.*
- unaffected 6.18.1 – ≤ 6.18.*
- unaffected 6.19 – ≤ *
References
References8
- https://git.kernel.org/stable/c/49b7806851f93fd342838c93f4f765e0cc5029b0 (opens in a new tab)
- https://git.kernel.org/stable/c/4445adedae770037078803d1ce41f9e88a1944b6 (opens in a new tab)
- https://git.kernel.org/stable/c/d129dc2a5d59b4d9cd2cc0b6eeb04df8461199f0 (opens in a new tab)
- https://git.kernel.org/stable/c/34620eb602aa432f090b2b784ee5c5070fb16cf9 (opens in a new tab)
- https://git.kernel.org/stable/c/61871c83259a511980ec2664964cecc69005398b (opens in a new tab)
- https://git.kernel.org/stable/c/25411f5fcf5743131158f337c99c2bbf3f8477f5 (opens in a new tab)
- https://git.kernel.org/stable/c/e841d8ea722315b781c4fc5bf4f7670fbca88875 (opens in a new tab)
- https://git.kernel.org/stable/c/6ef0e1c10455927867cac8f0ed6b49f328f8cf95 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-203742 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-68255)Record last updated .