In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing… (CVE-2026-64443)
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past len. Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel rtl8723bs staging driver involves an out-of-bounds read in the update_beacon_info() function's IE parsing loop. The loop increments by (pIE->length + 2) but only checks that the index is less than the buffer length, allowing a malicious Beacon frame with a crafted last IE to cause reads beyond the allocated buffer. The patch introduces two guards: one to break if fewer than the size of the IE header remain, and another to break if the IE's declared length extends beyond the buffer. It also adjusts the loop increment to use sizeof(*pIE) + pIE->length for consistency and safety.
Potential Impact
This vulnerability allows a malicious access point to send a specially crafted Beacon frame that triggers an out-of-bounds read in the kernel driver. Such a read can potentially lead to information disclosure or kernel memory corruption, which may affect system stability or security. However, no known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel rtl8723bs staging driver by adding proper bounds checks in the IE parsing loop. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor or Linux kernel advisories for the current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing… (CVE-2026-64443)
Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past len. Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel rtl8723bs staging driver involves an out-of-bounds read in the update_beacon_info() function's IE parsing loop. The loop increments by (pIE->length + 2) but only checks that the index is less than the buffer length, allowing a malicious Beacon frame with a crafted last IE to cause reads beyond the allocated buffer. The patch introduces two guards: one to break if fewer than the size of the IE header remain, and another to break if the IE's declared length extends beyond the buffer. It also adjusts the loop increment to use sizeof(*pIE) + pIE->length for consistency and safety.
Potential Impact
This vulnerability allows a malicious access point to send a specially crafted Beacon frame that triggers an out-of-bounds read in the kernel driver. Such a read can potentially lead to information disclosure or kernel memory corruption, which may affect system stability or security. However, no known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel rtl8723bs staging driver by adding proper bounds checks in the IE parsing loop. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor or Linux kernel advisories for the current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-cffr-qfxf-qjr4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64443"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542089c2644c7f8082d00
Added to database: 07/25/2026, 23:08:56 UTC
Last enriched: 07/25/2026, 23:20:28 UTC
Last updated: 09/07/2026, 11:00:11 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.