CVE-2026-64443

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in Linux Kernel RTL8723BS Driver

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past len. Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64443

EUVD

EUVD-2026-48787

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is an out-of-bounds (OOB) read vulnerability in the Linux kernel's staging driver for Realtek RTL8723bs Wi-Fi chips. The issue occurs in the update_beacon_info() function when parsing Beacon frames from access points (APs). The loop processes information elements (IEs) but fails to properly validate buffer boundaries, allowing a malicious AP to read memory outside the intended receive buffer by manipulating IE lengths.

Detection Guidance

This vulnerability involves an out-of-bounds read in the Linux kernel's staging driver for RTL8723BS Wi-Fi chips. Detection requires checking for kernel versions affected by this issue and monitoring for malformed beacon frames from access points. Use commands like 'uname -a' to check kernel version and 'dmesg | grep rtl8723bs' to look for driver-related errors.

Impact Analysis

If exploited, this vulnerability could allow an attacker within Wi-Fi range to read sensitive kernel memory. This might expose sensitive data or crash the system. The impact depends on kernel memory contents and system configuration. Exploitation requires the vulnerable system to be within range of a malicious access point.

Compliance Impact

This vulnerability involves an out-of-bounds (OOB) read in the Linux kernel's staging driver for RTL8723BS Wi-Fi chips. It could allow malicious access points to read memory beyond allocated buffers, potentially exposing sensitive data. While not directly tied to GDPR or HIPAA, such memory corruption risks may lead to unauthorized data access, impacting compliance with data protection standards that require safeguarding personal or health information.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this issue. Check your distribution's security updates or compile a kernel with the staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop patch applied.

Hi! I’m here to help you understand CVE-2026-64443. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70