CVE-2025-68254: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68254 is an out-of-bounds read vulnerability in the Linux kernel's staging: rtl8723bs Wi-Fi driver, specifically in the OnBeacon function's Extended Supported Rates (ESR) Information Element (IE) parsing logic. The flaw was disclosed on December 16, 2025, and affects all Linux kernel versions from the initial commit up to the patched releases (6.12.62, 6.17.12, 6.18.1, and 6.19-rc1). A CVSS score has not yet been formally assigned by NVD, though Feedly estimates the severity as Medium with an EPSS score of 0.000150 (Feedly, CVE Record).

The root cause is a missing boundary check (CWE class: out-of-bounds read) in the OnBeacon handler within the rtl8723bs staging driver. Specifically, the code accessed *(p + 1 + ielen) and *(p + 2 + ielen) without first verifying that these offsets fall within the bounds of the received Wi-Fi frame buffer. An attacker within Wi-Fi radio range can craft a malformed beacon frame with an ESR IE positioned at the very end of the buffer, causing the kernel to read memory beyond the allocated buffer. The fix adds a boundary check to validate that the ESR IE body and subsequent bytes are within the frame limits before access (CVE Record, kernel.org patches).

Successful exploitation of this vulnerability can cause an out-of-bounds memory read in the Linux kernel, potentially triggering a kernel panic and resulting in a denial of service (system crash) on affected hosts. The vulnerability is triggered by receiving a malformed Wi-Fi beacon frame, meaning any system with an active rtl8723bs Wi-Fi adapter scanning for networks is potentially at risk. While the primary impact is availability (kernel panic/crash), out-of-bounds reads can also expose sensitive kernel memory contents, posing a limited confidentiality risk depending on what data resides adjacent to the frame buffer (Feedly).

1. Reconnaissance: Identify target systems running Linux with the rtl8723bs staging Wi-Fi driver loaded and actively scanning for Wi-Fi networks (e.g., laptops or embedded devices with Realtek RTL8723BS chipsets).
2. Position within Wi-Fi range: The attacker must be within radio range of the target device, as the attack vector is adjacent network (Wi-Fi).
3. Craft malformed beacon frame: Construct a malformed 802.11 beacon frame containing an Extended Supported Rates (ESR) Information Element positioned at the very end of the frame buffer, such that *(p + 1 + ielen) and *(p + 2 + ielen) would fall outside the buffer boundary.
4. Transmit the beacon: Use a tool capable of injecting raw 802.11 frames (e.g., scapy with a monitor-mode Wi-Fi adapter, or mdk3/mdk4) to broadcast the malformed beacon on the target's operating channel.
5. Trigger OOB read: The target system's rtl8723bs driver processes the beacon in OnBeacon, performs the unvalidated memory access, and may trigger a kernel panic (denial of service) or expose adjacent kernel memory.

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing the rtl8723bs driver or OnBeacon function; stack traces involving staging/rtl8723bs module.
• System Behavior: Unexpected system crashes or kernel panics on devices with RTL8723BS Wi-Fi adapters, particularly when scanning for Wi-Fi networks in environments with unusual beacon frames.
• Network: Anomalous 802.11 beacon frames with malformed or truncated ESR Information Elements detected via wireless packet capture (e.g., Wireshark in monitor mode) on the operating channel.

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable versions: 6.12.62, 6.17.12, 6.18.1, and 6.19-rc1 (kernel.org patches). Downstream distributions including Debian (linux 6.1.162-1, DLA-4476-1), Ubuntu (USN-8096-x, USN-8094-x, USN-8152-1, USN-8179-x, USN-8184-1, USN-8185-x, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE, and Oracle Linux have also issued updated kernel packages (Debian LTS, Ubuntu USN-8096-1). As a workaround where patching is not immediately possible, unloading or blacklisting the rtl8723bs kernel module (modprobe -r r8723bs or adding it to /etc/modprobe.d/blacklist.conf) will prevent exploitation at the cost of disabling the affected Wi-Fi adapter.

The vulnerability received routine coverage from Linux security news aggregators and distribution security teams, with no notable researcher commentary or significant social media discussion identified. Multiple downstream vendors (Debian, Ubuntu, SUSE, Oracle) issued kernel security updates addressing this and other kernel vulnerabilities in batch advisories (Debian LTS, Ubuntu USN-8096-1).