The Linux kernel rtl8723bs staging driver contained a vulnerability (CVE-2026-64440) in the HT_caps_handler() function where the length field from an over-the-air 802.11 AssocResponse frame was used unchecked to iterate and write into a fixed-size 26-byte array (HT_caps.u.HT_cap[]). A malicious access point could exploit this by setting the length to a large value (up to 255), causing up to 229 bytes of out-of-bounds writes into adjacent memory fields within struct mlme_ext_info. The fix involved using the umin() function to truncate the iteration count to the array size, thus ignoring excess data and preventing memory corruption while preserving HT mode functionality.

The vulnerability allows a malicious Wi-Fi access point to cause out-of-bounds memory writes in the kernel's wireless driver, potentially leading to memory corruption. The exact impact is not detailed in the provided data, and no known exploits are reported. The out-of-bounds write could affect adjacent kernel memory structures, which might lead to system instability or privilege escalation if exploited.

A fix has been implemented in the Linux kernel to address this vulnerability by truncating the iteration length in HT_caps_handler(). Users should update to the patched kernel version once available. Since this is a kernel-level vulnerability, applying the official kernel update from the Linux distribution vendor is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult their vendor advisory for the exact fixed kernel versions and update accordingly.