Skip to main content
VulnerabilityPublished Updated

CVE-2026-64446: Linux kernel · staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in b9c4bf133c3c47e23baf4f5403b98a953bf58606 : patch Linux kernel soon.

Data as of 6 Nov 2026, 18:36 UTC

Severity
High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
CISA SSVC
Exploitation
No evidence of active exploitation and no public proof of concept
Automatable
Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact
Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch
Available – fixed in b9c4bf133c3c47e23baf4f5403b98a953bf58606, a94a643a80a84ceb8139061c3d6bf988d75e45a5, 2131621986c62c86109ce4d84cf73a73757eb8a6 +5

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 25 Jul 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < b9c4bf133c3c47e23baf4f5403b98a953bf58606
Fixed in
  • b9c4bf133c3c47e23baf4f5403b98a953bf58606
LinuxLinuxAffected
  • ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < a94a643a80a84ceb8139061c3d6bf988d75e45a5
Fixed in
  • a94a643a80a84ceb8139061c3d6bf988d75e45a5
LinuxLinuxAffected
  • ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 2131621986c62c86109ce4d84cf73a73757eb8a6
Fixed in
  • 2131621986c62c86109ce4d84cf73a73757eb8a6
LinuxLinuxAffected
  • ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 138cd190efd56ab36c9fdd8fef8749d06937f24b
Fixed in
  • 138cd190efd56ab36c9fdd8fef8749d06937f24b
LinuxLinuxAffected
  • ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 46f66c16a95191d9aca07a72ae6b1252a244e26c
Fixed in
  • 46f66c16a95191d9aca07a72ae6b1252a244e26c
LinuxLinuxAffected
  • ≥ 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 6f20d7b0ee47c470734a69379b0fc6647c519603
Fixed in
  • 6f20d7b0ee47c470734a69379b0fc6647c519603

AI-suggested

A fix is available and has been committed in multiple Linux kernel versions as indicated by the fixed commit hashes. Users should update their Linux kernel to a version including these fixes. No additional mitigation is required beyond applying the official patch.

Description

A heap buffer overflow vulnerability exists in the Linux kernel's rtl8723bs staging driver in the function rtw_cfg80211_set_wpa_ie(). The flaw arises when a crafted WPA IE of length 255 is supplied, causing a memcpy operation to overflow a 256-byte buffer by one byte. This overflow can corrupt adjacent memory. The issue is fixed by adding explicit bounds checks to reject oversized WPA IE inputs.

References

Community reviews

Loading reviews…