In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()… (CVE-2026-64446)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented that adds explicit bounds checks to prevent the heap buffer overflow by rejecting WPA IE inputs exceeding the buffer size. Since this is a Linux kernel vulnerability, users should apply the official kernel updates or patches that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the vendor or Linux kernel advisory for the current remediation status and apply updates accordingly.
Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
Impact
The vulnerability allows a local user to trigger a heap buffer overflow by supplying a crafted WPA IE in a connect request via nl80211. This overflow could corrupt adjacent memory, potentially leading to undefined behavior such as crashes or memory corruption within the kernel's wireless driver. No known exploits in the wild have been reported. The impact is limited to local users with the ability to send crafted connect requests to the affected driver.
Summary
The Linux kernel rtl8723bs staging driver contained a heap buffer overflow vulnerability in the rtw_cfg80211_set_wpa_ie() function. The supplicant_ie buffer is 256 bytes, but the code copied wpa_ielen + 2 bytes without proper bounds checking, where wpa_ielen is a length field up to 255. A crafted WPA IE of length 255 causes the memcpy to copy 257 bytes, overflowing the buffer by one byte into adjacent memory. The existing length check in rtw_parse_wpa_ie() was insufficient due to incorrect comparison logic. The vulnerability was resolved by adding explicit bounds checks before the memcpy to reject oversized IEs.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64446 (opens in a new tab)
- git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b (opens in a new tab)
- git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6 (opens in a new tab)
- git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c (opens in a new tab)
- git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655 (opens in a new tab)
- git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28 (opens in a new tab)
- git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603 (opens in a new tab)
- git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5 (opens in a new tab)
- git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606 (opens in a new tab)