CVE-2026-64442

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in Linux Kernel RTL8723BS Driver

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer. - join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions. Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue. Apply the two-guard pattern established in update_beacon_info(): 1. Break if fewer than sizeof(*pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64442

EUVD

EUVD-2026-48786

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 4.12 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's staging driver for Realtek RTL8723BS Wi-Fi chips. It involves out-of-bounds (OOB) reads when parsing Information Elements (IEs) in Wi-Fi frames. Two functions, issue_assocreq() and join_cmd_hdl(), fail to check buffer bounds before accessing IE data, allowing a malicious access point to send malformed frames that read memory outside the intended buffer.

Detection Guidance

This vulnerability involves out-of-bounds reads in the Linux kernel's rtl8723bs driver during IE parsing. Detection requires checking for vulnerable kernel versions and monitoring for malformed beacon or probe-response frames from APs. Use 'uname -a' to check kernel version and 'dmesg | grep rtl8723bs' to look for driver-related errors.

Impact Analysis

If exploited, this flaw could allow an attacker within Wi-Fi range to crash the system or potentially execute arbitrary code on affected devices. Systems using vulnerable Linux kernels with the RTL8723BS driver may experience instability or security breaches when connecting to malicious access points.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized access or data exposure on affected systems. Organizations subject to GDPR or HIPAA may face increased risk of breaches, leading to potential regulatory penalties or reputational damage if exploited.

Mitigation Strategies

Apply the latest kernel updates to patch the vulnerability. If immediate patching is not possible, disable the rtl8723bs driver module if unused. Monitor network traffic for malformed frames and restrict access to untrusted APs.

Hi! I’m here to help you understand CVE-2026-64442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70