Re: [PATCH v6 0/5] staging: rtl8723bs: fix multiple security vulnerabilities

[Greg KH]

On Fri, Apr 17, 2026 at 07:10:43AM +0100, Delene Tchio Romuald wrote:
> This series fixes five remotely-triggerable memory safety issues in
> the rtl8723bs driver. All of them are reachable from the air by an
> attacker within WiFi radio range, without authentication, via
> crafted management or data frames:
> 
>   1. Heap buffer overflow in recvframe_defrag() when reassembling
>      fragmented frames whose total payload exceeds the receive
>      buffer capacity.
>   2. Integer underflow in TKIP MIC verification when a frame is
>      shorter than the sum of header, IV, ICV and MIC sizes.
>   3. Out-of-bounds read in portctrl() when a non-EAPOL frame is
>      shorter than the 802.11 header + IV + LLC + ether_type.
>   4. Out-of-bounds reads in three IE walkers (rtw_get_wapi_ie(),
>      rtw_get_sec_ie(), rtw_get_wps_ie()) due to missing validation
>      of the TLV length byte and of the byte ranges touched by the
>      subsequent memcmp() calls.
>   5. Integer underflow in rtw_wep_decrypt() when a WEP frame is
>      shorter than the header + IV + ICV.
> 
> Each patch was found by code review and is not tested on hardware.

Please address the comments found here:
	https://sashiko.dev/#/patchset/20260417061048.62484-1-delenetchior1@xxxxxxxxx

and ideally, test it on some real hardware to verify it all still works?

thanks,

greg k-h