CVE-2026-64441

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Linux Kernel RTL8723BS Driver

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Three IE/attribute parsing functions have missing bounds checks. rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer without verifying that the header bytes (tag + length) are within the remaining buffer before reading them. Additionally, rtw_get_sec_ie() compares the 4-byte WPA OUI at cnt+2 without checking that at least 6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at cnt+6 without checking that at least 10 bytes remain. rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at entry, before verifying that wps_ielen is large enough to contain the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside the attribute loop, get_unaligned_be16() is called on attr_ptr and attr_ptr+2 without checking that 4 bytes remain in the buffer. Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie() and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum IE length requirement, add a wps_ielen < 6 early return in rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64441

EUVD

EUVD-2026-48785

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's staging driver for Realtek RTL8723BS WiFi chips. It involves three functions that parse information elements (IEs) in WiFi frames without proper bounds checking. This allows out-of-bounds reads when processing malformed WiFi frames, potentially exposing kernel memory.

Detection Guidance

This vulnerability involves out-of-bounds reads in the Linux kernel's RTL8723BS Wi-Fi driver. Detection requires checking if your system uses a vulnerable kernel version with the affected driver. Inspect kernel logs for crashes or memory corruption related to wireless operations. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

An attacker within WiFi range could send specially crafted frames to trigger out-of-bounds reads in the kernel. This might lead to system crashes, information leaks, or privilege escalation if combined with other exploits. It primarily affects systems using the RTL8723BS WiFi chip.

Compliance Impact

This vulnerability involves out-of-bounds (OOB) reads in Wi-Fi IE parsing functions in the Linux kernel. While it primarily poses a security risk through potential memory corruption or information disclosure, it does not directly impact compliance with standards like GDPR or HIPAA. Compliance risks would arise only if exploitation led to unauthorized data access or processing, which is not specified in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If you are using a distribution with backported fixes, ensure your kernel is updated through your package manager. Avoid using vulnerable Wi-Fi drivers until patched.

Hi! I’m here to help you understand CVE-2026-64441. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70