CVE-2026-64444VulnerabilityPublished 07/25/2026

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in… (CVE-2026-64444)

Source GCVE Database

Severity

Medium

No CVSS score published yet

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.3% chance of exploitation in 30 days – higher than 19% of CVEs

What to do

AI-suggested

A fix has been implemented in the Linux kernel rtl8723bs staging driver to add boundary checks preventing out-of-bounds reads in the OnAssocRsp() IE parsing loop. Users should update their Linux kernel to a version that includes this patch once available. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel release notes or vendor advisories for the exact fixed version and apply updates accordingly.

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_len. When a malicious AP sends an AssocResponse whose last IE has only one byte remaining in the frame (the element_id byte lands at pkt_len-1), the loop reads pIE->length from pframe[pkt_len], which is one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond pkt_len, silently passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past pkt_len.

Summary

The Linux kernel rtl8723bs staging driver contained a vulnerability in the OnAssocRsp() function where the IE parsing loop could read beyond the allocated receive buffer. This occurred because the loop advanced by (pIE->length + 2) bytes each iteration but only checked that the loop index was less than the packet length (pkt_len). A malicious access point could send an association response frame where the last IE's element_id byte was at pkt_len-1, causing the code to read pIE->length from one byte past the buffer. Additionally, the IE length field could specify a length extending beyond pkt_len, causing truncated IEs to be passed to handlers. The patch adds two guards: one to break the loop if fewer than the IE header bytes remain, and another to break if the IE's declared length extends beyond pkt_len, thus preventing OOB reads.

Impact

This vulnerability allows a malicious access point to cause out-of-bounds reads in the kernel memory when processing association response frames. Such OOB reads can lead to information disclosure or kernel memory corruption, potentially destabilizing the system or enabling further exploitation. However, no known exploits in the wild have been reported.

What to do

Description

AnalysisAI-generated, updated 07/25/2026, 23:20:52 UTC

Technical details

References

Related threats