All vulnerabilities
CVE-2026-98160

Linux: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6c017ab2b0e1b60b5be94636c94720347213d78bAlso 4520d673d49dabfd42c008a33889251025f7d6d5, 423574feaed192063ef0cd0813fb85425f39e539 and 3 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 6c017ab2b0e1b60b5be94636c94720347213d78bLinuxCVE List
  • 4520d673d49dabfd42c008a33889251025f7d6d5LinuxCVE List
  • 423574feaed192063ef0cd0813fb85425f39e539LinuxCVE List
  • 737c928ff5092d7e55128a232c231248fc993777LinuxCVE List
  • 911190f0b9511c3c81f2f2484414c1ae26f636b3LinuxCVE List
  • 264676418b726baca7be49171e306b6aa05cceb0LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()

padapter->HalData is allocated via vzalloc(), but incorrectly freed using kfree() in the rtw_sdio_if1_init() error path. Using kfree() to release this vmalloc-backed buffer can lead to memory corruption.

Use rtw_hal_data_deinit() to pair the free correctly and free HalData with vfree().

The bug was first flagged by an experimental static analysis tool we are developing for kernel memory-management bugs. Manual inspection confirms that the issue is still present in current mainline.

An x86_64 allyesconfig build showed no new warnings. As we do not have suitable RTL8723BS SDIO hardware to test with, no runtime testing was able to be performed.

Text from CVE List

Affected versions 18

  • Linuxaffected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b before ff6d1ba247b5c62bdb678f1069abc86ad88a1402CVE List
  • Linuxaffected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b before d6158333d630a1b21d8914feaf77a6f5deb185d9CVE List
  • Linuxaffected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 6c017ab2b0e1b60b5be94636c94720347213d78bCVE List
  • Linuxaffected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 4520d673d49dabfd42c008a33889251025f7d6d5CVE List
  • Linuxaffected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 423574feaed192063ef0cd0813fb85425f39e539CVE List
  • Linuxaffected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 737c928ff5092d7e55128a232c231248fc993777CVE List
  • Linuxaffected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 911190f0b9511c3c81f2f2484414c1ae26f636b3CVE List
  • Linuxaffected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 264676418b726baca7be49171e306b6aa05cceb0CVE List
  • Linuxaffected: 4.12CVE List
  • Linuxunaffected: all versions before 4.12CVE List
  • Linuxunaffected: 5.10.270 through 5.10.*CVE List
  • Linuxunaffected: 5.15.221 through 5.15.*CVE List
  • Linuxunaffected: 6.1.188 through 6.1.*CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.110 through 6.12.*CVE List
  • Linuxunaffected: 6.18.52 through 6.18.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8