VulnerabilityPublished 25 Jul 2026

CVE-2026-64440: Linux kernel · staging: rtl8723bs: fix OOB write in HT_caps_handler()

Source GCVE Database

Authoritative record:CVE-2026-64440· High 8.1

Not known to be exploited · CVSS 8.1 High · fixed in f8001e1a516ba3b495728c65b61f799cbfad6bd0 : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

CVSS 3.1 base score

8.1High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f8001e1a516ba3b495728c65b61f799cbfad6bd0, bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a, 918537a0fbed85aab61fa28ad75e6279070610c9 +4

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-mgm7-8p4q-p28m

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < f8001e1a516ba3b495728c65b61f799cbfad6bd0	Fixed in f8001e1a516ba3b495728c65b61f799cbfad6bd0
LinuxLinux	Affected ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a	Fixed in bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a
LinuxLinux	Affected ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 918537a0fbed85aab61fa28ad75e6279070610c9	Fixed in 918537a0fbed85aab61fa28ad75e6279070610c9
LinuxLinux	Affected ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d	Fixed in 225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d
LinuxLinux	Affected ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 37f642d47c3648a707df3ceb092eee1adffbfd28	Fixed in 37f642d47c3648a707df3ceb092eee1adffbfd28
LinuxLinux	Affected ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 8c872b47c7fc32e95e0da1db7512388794adcd69	Fixed in 8c872b47c7fc32e95e0da1db7512388794adcd69

AI-suggested

A fix has been implemented in the Linux kernel to address this vulnerability by truncating the iteration length in HT_caps_handler(). Users should update to the patched kernel version once available. Since this is a kernel-level vulnerability, applying the official kernel update from the Linux distribution vendor is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult their vendor advisory for the exact fixed kernel versions and update accordingly.

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->length bytes and writes into HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct HT_caps_element). Because pIE->length is a raw u8 from an over-the-air 802.11 AssocResponse frame and is never validated, a malicious AP can set it up to 255, causing up to 229 bytes of out-of-bounds writes into adjacent fields of struct mlme_ext_info. Truncate the iteration count to the size of HT_caps.u.HT_cap using umin() so that data from a longer-than-expected IE is silently ignored rather than written out of bounds, preserving interoperability with APs that pad the element. An early return on oversized IEs was considered but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1 assignment that precedes the loop, silently disabling HT mode for APs that append extra bytes to the HT Capabilities IE.

Impact

The vulnerability allows a malicious Wi-Fi access point to cause out-of-bounds memory writes in the kernel's wireless driver, potentially leading to memory corruption. The exact impact is not detailed in the provided data, and no known exploits are reported. The out-of-bounds write could affect adjacent kernel memory structures, which might lead to system instability or privilege escalation if exploited.

Summary

The Linux kernel rtl8723bs staging driver contained a vulnerability (CVE-2026-64440) in the HT_caps_handler() function where the length field from an over-the-air 802.11 AssocResponse frame was used unchecked to iterate and write into a fixed-size 26-byte array (HT_caps.u.HT_cap[]). A malicious access point could exploit this by setting the length to a large value (up to 255), causing up to 229 bytes of out-of-bounds writes into adjacent memory fields within struct mlme_ext_info. The fix involved using the umin() function to truncate the iteration count to the array size, thus ignoring excess data and preventing memory corruption while preserving HT mode functionality.

References

Community reviews

Loading reviews…