Medium · published September 25, 2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
padapter->HalData is allocated via vzalloc(), but incorrectly freed
using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to
release this vmalloc-backed buffer can lead to memory corruption.
Use rtw_hal_data_deinit() to pair the free correctly and free
HalData with vfree().
The bug was first flagged by an experimental static analysis tool we
are developing for kernel memory-management bugs. Manual inspection
confirms that the issue is still present in current mainline.
An x86_64 allyesconfig build showed no new warnings. As we do not have
suitable RTL8723BS SDIO hardware to test with, no runtime testing was
able to be performed.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.12, < 5.10.270 | 5.10.270 |
| linux/linux_kernel | ≥ 5.11, < 5.15.221 | 5.15.221 |
| linux/linux_kernel | ≥ 5.16, < 6.1.188 | 6.1.188 |
| linux/linux_kernel | ≥ 6.2, < 6.6.157 | 6.6.157 |
| linux/linux_kernel | ≥ 6.7, < 6.12.110 | 6.12.110 |
| linux/linux_kernel | ≥ 6.13, < 6.18.52 | 6.18.52 |
| linux/linux_kernel | ≥ 6.19, < 7.2.6 | 7.2.6 |