CVE-2026-64440

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Write in Linux Kernel RTL8723BS Driver

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->length bytes and writes into HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct HT_caps_element). Because pIE->length is a raw u8 from an over-the-air 802.11 AssocResponse frame and is never validated, a malicious AP can set it up to 255, causing up to 229 bytes of out-of-bounds writes into adjacent fields of struct mlme_ext_info. Truncate the iteration count to the size of HT_caps.u.HT_cap using umin() so that data from a longer-than-expected IE is silently ignored rather than written out of bounds, preserving interoperability with APs that pad the element. An early return on oversized IEs was considered but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1 assignment that precedes the loop, silently disabling HT mode for APs that append extra bytes to the HT Capabilities IE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64440

EUVD

EUVD-2026-48784

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's staging driver for Realtek RTL8723BS Wi-Fi chips. It involves an out-of-bounds write in the HT_caps_handler() function, which processes 802.11 association response frames. A malicious access point can send a crafted frame with an oversized length field, causing the function to write beyond the fixed 26-byte buffer into adjacent memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's staging driver for RTL8723BS Wi-Fi chips. Detection requires checking if your system uses this driver and if the kernel version is vulnerable. Inspect loaded kernel modules with lsmod | grep rtl8723bs and check kernel version with uname -a. If the driver is loaded and kernel is unpatched, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker within Wi-Fi range to cause memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution on affected devices. It may also enable denial-of-service conditions by destabilizing the kernel.

Compliance Impact

This vulnerability is a memory corruption issue in the Linux kernel's Wi-Fi driver (rtl8723bs) that could allow remote attackers to execute arbitrary code or cause a denial of service via maliciously crafted network packets. It does not directly relate to data protection or privacy compliance standards like GDPR or HIPAA, which focus on unauthorized data access or disclosure.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this CVE. If using a distribution kernel, apply available security updates. For custom kernels, ensure the staging: rtl8723bs: fix OOB write patch is applied. Disable the rtl8723bs driver if not needed using modprobe -r rtl8723bs.

Hi! I’m here to help you understand CVE-2026-64440. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70