HIGH Introduced in 4.14
rsi Beacon Overflow
CVE-2026-93802
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: validate beacon length before fixed buffer copy rsi_prepare_beacon() copies the mac80211 beacon frame after FRAME_DESC_SZ into a management skb whose usable tailroom may be smaller than MAX_MGMT_PKT_SIZE after alignment. Validate the beacon length against the actual tailroom before the copy and skb_put(). Leave ownership of the management skb with the caller on error, matching the existing rsi_send_beacon() cleanup path.
02KernelScan AI Analysis
Risk summary
A local attacker who can configure an RSI WiFi device as an access point can trigger a heap buffer overflow by setting a beacon template larger than the driver's management buffer. This can corrupt kernel memory, potentially leading to privilege escalation or a system crash. Systems without RSI WiFi hardware or without local configuration access are not affected.
Vulnerability analysis
The RSI WiFi driver copies a mac80211 beacon frame into a pre-allocated management socket buffer without first verifying that the buffer has sufficient tailroom for the beacon data and frame descriptor overhead. When the beacon length exceeds the available space, the copy writes past the end of the buffer, corrupting adjacent kernel heap memory. The fix adds a validation check that compares the beacon length against the actual buffer tailroom before the copy, returning an error if the beacon would not fit and leaving buffer cleanup to the caller. This code path is reached when configuring an RSI WiFi device as an access point, which requires local access and CAP_NET_ADMIN privileges to set the beacon template via nl80211.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.14 | 5.10.271 | 795ba65f46fe |
| 5.15 | 4.14 | 5.15.222 | 66a964432b27 |
| 6.1 | 4.14 | 6.1.189 | 7f99742c3c28 |
| 6.6 | 4.14 | 6.6.158 | f08d7f3c9163 |
| 6.12 | 4.14 | 6.12.111 | 87710ad633ce |
| 6.18 | 4.14 | 6.18.53 | 266f195d5a14 |
| mainline | 4.14 | 7.2 | 8ecdeb8b8a33 |
| cip/6.12 | 4.14 | 6.12.111-cip32 | 87710ad633ce |