# CVE-2026-46305

## Summary

- **CVE ID:** CVE-2026-46305
- **Severity:** MEDIUM
- **CVSS Score:** 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Jun 8, 2026
- **Last Modified:** Sep 17, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc

The return value of kzalloc_flex() is used without
ensuring that the allocation succeeded, and the
pointer is dereferenced unconditionally.

Guard the access to the allocated structure to
avoid a potential NULL pointer dereference if the
allocation fails.

## Affected Products

- Linux — Linux (980cd426a25747daf8ed25e2a1904b2d26ffbb3d)
- Linux — Linux (7.0)
- Linux — Linux (0)
- Linux — Linux (7.0.7)
- Linux — Linux (7.1-rc3)
- Linux — Linux (7.1)
- Linux — Linux (368f19a5ed15f396db4ec2182c1311a7fa4f993b)

## References

- [CNA](https://git.kernel.org/stable/c/0a5f411becfb7c57aa89827213d31ef23a03d75a)
- [CNA](https://git.kernel.org/stable/c/bc851db06045a40c18233dd76ef0562d7f8bb6db)
- [CNA](https://git.kernel.org/stable/c/7d4024037ee309a8f0cb86b4093d59da0e135db8)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.11%
- **EPSS Percentile:** 1.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._