rsi Beacon Overflow

Vulnerability analysis

The RSI WiFi driver copies a mac80211 beacon frame into a pre-allocated management socket buffer without first verifying that the buffer has sufficient tailroom for the beacon data and frame descriptor overhead. When the beacon length exceeds the available space, the copy writes past the end of the buffer, corrupting adjacent kernel heap memory. The fix adds a validation check that compares the beacon length against the actual buffer tailroom before the copy, returning an error if the beacon would not fit and leaving buffer cleanup to the caller. This code path is reached when configuring an RSI WiFi device as an access point, which requires local access and CAP_NET_ADMIN privileges to set the beacon template via nl80211.