In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and… (CVE-2026-64441)
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Three IE/attribute parsing functions have missing bounds checks. rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer without verifying that the header bytes (tag + length) are within the remaining buffer before reading them. Additionally, rtw_get_sec_ie() compares the 4-byte WPA OUI at cnt+2 without checking that at least 6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at cnt+6 without checking that at least 10 bytes remain. rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at entry, before verifying that wps_ielen is large enough to contain the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside the attribute loop, get_unaligned_be16() is called on attr_ptr and attr_ptr+2 without checking that 4 bytes remain in the buffer. Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie() and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum IE length requirement, add a wps_ielen < 6 early return in rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.
AI Analysis
Technical Summary
The Linux kernel rtl8723bs staging driver contained a vulnerability (CVE-2026-64441) due to missing bounds checks in three parsing functions: rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr(). Specifically, these functions iterated over raw IE buffers without verifying that header bytes and multi-byte comparisons were within the remaining buffer length, leading to potential out-of-bounds reads. The fix involved adding bounds checks before loop bodies, guarding multi-byte comparisons with minimum length requirements, and adding early returns when buffer lengths were insufficient.
Potential Impact
The vulnerability allows out-of-bounds reads in the affected parsing functions of the rtl8723bs driver in the Linux kernel. This could potentially lead to kernel memory disclosure or instability. However, no known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix has been implemented in the Linux kernel staging rtl8723bs driver by adding necessary bounds checks and early returns to prevent out-of-bounds reads. Users and administrators should update to a Linux kernel version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and… (CVE-2026-64441)
Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Three IE/attribute parsing functions have missing bounds checks. rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer without verifying that the header bytes (tag + length) are within the remaining buffer before reading them. Additionally, rtw_get_sec_ie() compares the 4-byte WPA OUI at cnt+2 without checking that at least 6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at cnt+6 without checking that at least 10 bytes remain. rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at entry, before verifying that wps_ielen is large enough to contain the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside the attribute loop, get_unaligned_be16() is called on attr_ptr and attr_ptr+2 without checking that 4 bytes remain in the buffer. Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie() and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum IE length requirement, add a wps_ielen < 6 early return in rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel rtl8723bs staging driver contained a vulnerability (CVE-2026-64441) due to missing bounds checks in three parsing functions: rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr(). Specifically, these functions iterated over raw IE buffers without verifying that header bytes and multi-byte comparisons were within the remaining buffer length, leading to potential out-of-bounds reads. The fix involved adding bounds checks before loop bodies, guarding multi-byte comparisons with minimum length requirements, and adding early returns when buffer lengths were insufficient.
Potential Impact
The vulnerability allows out-of-bounds reads in the affected parsing functions of the rtl8723bs driver in the Linux kernel. This could potentially lead to kernel memory disclosure or instability. However, no known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix has been implemented in the Linux kernel staging rtl8723bs driver by adding necessary bounds checks and early returns to prevent out-of-bounds reads. Users and administrators should update to a Linux kernel version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9jwg-48fr-mhc6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64441"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542099c2644c7f80838ab
Added to database: 07/25/2026, 23:08:57 UTC
Last enriched: 07/25/2026, 23:24:14 UTC
Last updated: 09/08/2026, 22:52:14 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.