Strix
26.1K

CVE-2025-68255

HIGHCVSS 8.8/10EPSS 0.19%

Last modified

CVE-2025-68255 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow. Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow. This prevents kernel stack corruption triggered by malformed association requests.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow. Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow. This prevents kernel stack corruption triggered by malformed association requests.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.19%

8.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 49b7806851f93fd342838c93f4f765e0cc5029b0; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 4445adedae770037078803d1ce41f9e88a1944b6; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < d129dc2a5d59b4d9cd2cc0b6eeb04df8461199f0; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 34620eb602aa432f090b2b784ee5c5070fb16cf9; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 61871c83259a511980ec2664964cecc69005398b; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 25411f5fcf5743131158f337c99c2bbf3f8477f5; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < e841d8ea722315b781c4fc5bf4f7670fbca88875; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 6ef0e1c10455927867cac8f0ed6b49f328f8cf95
LinuxLinux4.12

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2025-68255?
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow. Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow. This prevents kernel stack corruption triggered by malformed association requests.
How severe is CVE-2025-68255?
CVE-2025-68255 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.19% probability of exploitation in the next 30 days.
How do I fix CVE-2025-68255?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-68255?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST