CVE-2026-64446

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in Linux Kernel RTL8723BS Driver

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64446

EUVD

EUVD-2026-48790

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap buffer overflow vulnerability in the Linux kernel's staging driver for RTL8723BS Wi-Fi chips. It occurs when a local user sends a crafted WPA/WPA2 information element (IE) with a length of 255 bytes through nl80211. The driver incorrectly copies this IE into a 256-byte buffer without proper bounds checking, causing a one-byte overflow into an adjacent field.

Detection Guidance

This vulnerability involves a heap buffer overflow in the Linux kernel's rtl8723bs driver when handling WPA/WPA2 IE (Information Element) lengths. Detection requires checking for vulnerable kernel versions and inspecting network driver configurations. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

As a local user on a vulnerable system, an attacker could exploit this to corrupt kernel memory, potentially leading to crashes, privilege escalation, or arbitrary code execution. Systems using affected Wi-Fi hardware with vulnerable kernel versions are at risk.

Compliance Impact

This vulnerability involves a heap buffer overflow in the Linux kernel's Wi-Fi driver due to improper bounds checking when processing WPA/WPA2 IE (Information Element) lengths. While it does not directly impact GDPR or HIPAA compliance, it could potentially lead to unauthorized memory access or data exposure if exploited. Such vulnerabilities may violate security requirements in these standards, which mandate robust data protection and integrity measures.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. The patch adds bounds checks to prevent buffer overflow in the rtl8723bs driver's WPA/WPA2 IE handling. Check your distribution's security updates or kernel release notes for the fix.

Hi! I’m here to help you understand CVE-2026-64446. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70