CVE-2026-90017

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

rtw_action_frame_parse() takes a frame_len parameter but never

actually checks it before indexing into the frame body:

const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr);

...

c = frame_body[0];

...

a = frame_body[1];

frame_body already points 24 bytes (sizeof(struct

ieee80211_hdr_3addr)) into frame, so reading frame_body[0] and

frame_body[1] requires frame_len >= 26. A management action frame

shorter than that (e.g. exactly 24 bytes, the minimum a malicious

peer can send) causes a 1-2 byte out-of-bounds read.

This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and

cfg80211_rtw_mgmt_tx() in ioctl_cfg80211.c, both of which pass

attacker/user-influenced frame buffers and lengths straight through.

Add the missing length check before frame_body is dereferenced.