{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()  rtw_restruct_wmm_ie() scans in_ie for a WMM IE with:  \twhile (i \u003c in_len) { \t\t... \t\tif (i + 5 \u003c in_len \u0026\u0026 in_ie[i] == 0xDD \u0026\u0026 ...) { \t\t\t... \t\t\tbreak; \t\t} \t\ti += (in_ie[i + 1] + 2); /* to the next IE element */ \t}  When the \"i + 5 \u003c in_len\" match check fails simply because i is within 5 bytes of the end of the buffer (i.e. no WMM IE was found near the tail of in_ie), execution falls through to \"i += (in_ie[i + 1] + 2)\", which reads in_ie[i + 1]. If i == in_len - 1 at that point, this is a 1-byte out-of-bounds read of an attacker-influenced IE buffer built from association/scan data.  Commit a75281626fc8f (\"staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie\") added the \"i + 5 \u003c in_len\" guard to the match condition itself, but did not add an equivalent guard before the fallthrough advance, so the same class of OOB read remained reachable through the non-matching path.  Add an explicit bounds check before advancing to the next IE.",
  "id": "DEBIAN-CVE-2026-90016",
  "modified": "2026-09-17T04:47:36.152286789Z",
  "published": "2026-09-16T11:17:14.360Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90016"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-90016"
  ]
}