Skip to main content
CVE-2026-64443VulnerabilityPublished 07/25/2026

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing… (CVE-2026-64443)

Source GCVE Database

Severity
Medium

No CVSS score published yet

Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.3% chance of exploitation in 30 days – higher than 19% of CVEs

What to do

AI-suggested

A fix for this vulnerability has been implemented in the Linux kernel rtl8723bs staging driver by adding proper bounds checks in the IE parsing loop. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor or Linux kernel advisories for the current remediation guidance.

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past len. Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.

References