CVE-2026-64440
Received Received - Intake

Out-of-Bounds Write in Linux Kernel RTL8723BS Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->length bytes and writes into HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct HT_caps_element). Because pIE->length is a raw u8 from an over-the-air 802.11 AssocResponse frame and is never validated, a malicious AP can set it up to 255, causing up to 229 bytes of out-of-bounds writes into adjacent fields of struct mlme_ext_info. Truncate the iteration count to the size of HT_caps.u.HT_cap using umin() so that data from a longer-than-expected IE is silently ignored rather than written out of bounds, preserving interoperability with APs that pad the element. An early return on oversized IEs was considered but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1 assignment that precedes the loop, silently disabling HT mode for APs that append extra bytes to the HT Capabilities IE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64440
EUVD
EUVD-2026-48784

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's staging driver for Realtek RTL8723BS Wi-Fi chips. It involves an out-of-bounds write in the HT_caps_handler() function, which processes 802.11 association response frames. A malicious access point can send a crafted frame with an oversized length field, causing the function to write beyond the fixed 26-byte buffer into adjacent memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's staging driver for RTL8723BS Wi-Fi chips. Detection requires checking if your system uses this driver and if the kernel version is vulnerable. Inspect loaded kernel modules with lsmod | grep rtl8723bs and check kernel version with uname -a. If the driver is loaded and kernel is unpatched, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker within Wi-Fi range to cause memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution on affected devices. It may also enable denial-of-service conditions by destabilizing the kernel.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this CVE. If using a distribution kernel, apply available security updates. For custom kernels, ensure the staging: rtl8723bs: fix OOB write patch is applied. Disable the rtl8723bs driver if not needed using modprobe -r rtl8723bs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart