CVE-2026-64444

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in Linux Kernel RTL8723BS WiFi Driver

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_len. When a malicious AP sends an AssocResponse whose last IE has only one byte remaining in the frame (the element_id byte lands at pkt_len-1), the loop reads pIE->length from pframe[pkt_len], which is one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond pkt_len, silently passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past pkt_len.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-03

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-02

NVD

CVE-2026-64444

EUVD

EUVD-2026-48788

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 4.12 (inc) to 5.15.212 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's staging driver for Realtek RTL8723bs Wi-Fi chips. The issue occurs in the OnAssocRsp() function when parsing association response frames from access points. The loop incorrectly calculates the size of information elements (IEs) and may read beyond the allocated buffer, leading to out-of-bounds memory access.

Detection Guidance

This vulnerability is specific to the Linux kernel's staging driver for RTL8723BS WiFi chips. Detection requires checking if your system uses this driver and kernel version with the vulnerable code. Inspect loaded kernel modules with lsmod | grep rtl8723bs. Check kernel version with uname -a. Monitor system logs for crashes or errors related to wireless drivers.

Impact Analysis

An attacker within Wi-Fi range could exploit this to crash the system or potentially execute arbitrary code with kernel privileges. This could lead to denial of service, data corruption, or unauthorized access to sensitive information on affected devices using the vulnerable Realtek Wi-Fi driver.

Compliance Impact

This vulnerability is an out-of-bounds (OOB) read in the Linux kernel's Wi-Fi driver, which could allow unauthorized memory access. While it does not directly impact GDPR or HIPAA compliance, such vulnerabilities may lead to data breaches or unauthorized data exposure, which are key concerns under these regulations. Organizations must ensure proper patching and security controls to mitigate risks.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this vulnerability. If you cannot update immediately, disable the vulnerable rtl8723bs driver by blacklisting it with echo blacklist rtl8723bs | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf followed by sudo update-initramfs -u. Avoid connecting to untrusted wireless networks until patched.

Hi! I’m here to help you understand CVE-2026-64444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70