CVE-2026-64442
Received Received - Intake

Out-of-Bounds Read in Linux Kernel RTL8723BS Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer. - join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions. Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue. Apply the two-guard pattern established in update_beacon_info(): 1. Break if fewer than sizeof(*pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64442
EUVD
EUVD-2026-48786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's staging driver for Realtek RTL8723BS Wi-Fi chips. It involves out-of-bounds (OOB) reads when parsing Information Elements (IEs) in Wi-Fi frames. Two functions, issue_assocreq() and join_cmd_hdl(), fail to check buffer bounds before accessing IE data, allowing a malicious access point to send malformed frames that read memory outside the intended buffer.

Detection Guidance

This vulnerability involves out-of-bounds reads in the Linux kernel's rtl8723bs driver during IE parsing. Detection requires checking for vulnerable kernel versions and monitoring for malformed beacon or probe-response frames from APs. Use 'uname -a' to check kernel version and 'dmesg | grep rtl8723bs' to look for driver-related errors.

Impact Analysis

If exploited, this flaw could allow an attacker within Wi-Fi range to crash the system or potentially execute arbitrary code on affected devices. Systems using vulnerable Linux kernels with the RTL8723BS driver may experience instability or security breaches when connecting to malicious access points.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized access or data exposure on affected systems. Organizations subject to GDPR or HIPAA may face increased risk of breaches, leading to potential regulatory penalties or reputational damage if exploited.

Mitigation Strategies

Apply the latest kernel updates to patch the vulnerability. If immediate patching is not possible, disable the rtl8723bs driver module if unused. Monitor network traffic for malformed frames and restrict access to untrusted APs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64442. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart