In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and… (CVE-2026-64442)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix for this vulnerability has been implemented in the Linux kernel by adding proper bounds checks in the affected IE parsing loops. Users should apply the official kernel updates that include this patch when available. Since this is not a cloud service, remediation depends on applying the updated kernel version.
Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer. - join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions. Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue. Apply the two-guard pattern established in update_beacon_info(): 1. Break if fewer than sizeof(*pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.
Impact
An attacker controlling a malicious access point can trigger out-of-bounds reads in the affected driver by sending malformed beacon or probe-response frames with truncated information elements. This could potentially lead to kernel memory disclosure or instability. However, no known exploits are reported in the wild at this time.
Summary
CVE-2026-64442 is an out-of-bounds read vulnerability in the Linux kernel's rtl8723bs staging driver. Specifically, the functions issue_assocreq() and join_cmd_hdl() parse IE buffers without verifying that the length field is within the buffer bounds. If a malicious access point sends a truncated final IE with only an element_id byte and no length byte, the code reads one byte past the buffer end. The fix applies a two-guard pattern to break parsing if fewer than the size of the IE header remain or if the declared IE data extends beyond the buffer end.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64442 (opens in a new tab)
- git.kernel.org/stable/c/402f13ec95945f34a210b28df1f8740d3d4a58c5 (opens in a new tab)
- git.kernel.org/stable/c/4c21eec80cf502d9ea18e0b946246b2376452786 (opens in a new tab)
- git.kernel.org/stable/c/605ebd94d0f469204f3c9f2f84acc71e43e2780f (opens in a new tab)
- git.kernel.org/stable/c/a830bdc82461353bf7b1f8a2ad2689bf5d2de444 (opens in a new tab)
- git.kernel.org/stable/c/ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e (opens in a new tab)
- git.kernel.org/stable/c/bc881c9915c4468747d0ca5fd1abd7b313cfb0f4 (opens in a new tab)
- git.kernel.org/stable/c/c38d16b1ffac385c9e4b38447cd5c46af1114b58 (opens in a new tab)
- git.kernel.org/stable/c/ef61d628dfad38fead1fd2e08979ae9126d011d5 (opens in a new tab)