In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth()… (CVE-2026-64445)
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: length = len - WLAN_HDR_A3_LEN - iv_len and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to size_t, causes crc32_le() to read far beyond the frame buffer. Add a minimum length check before accessing the IV field and calling the decryption path. When processing a seq=3 response, rtw_get_ie() stores the Challenge Text IE length in ie_len, but the subsequent memcmp() always reads 128 bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of exactly 128 bytes; reject any IE whose length field differs, matching the check already applied to OnAuthClient().
AI Analysis
Technical Summary
The Linux kernel rtl8723bs staging driver had two vulnerabilities in the OnAuth() function's shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() was called without verifying the frame length, leading to a length underflow and an out-of-bounds read in crc32_le(). Additionally, during processing of a seq=3 response, rtw_get_ie() stored the Challenge Text IE length but memcmp() read a fixed 128 bytes regardless of the actual length, violating IEEE 802.11 standards and causing an out-of-bounds read. The fixes add minimum length checks before accessing the IV field and enforce strict length validation on the Challenge Text IE.
Potential Impact
These vulnerabilities can cause out-of-bounds reads in kernel memory during WEP decryption and Challenge Text IE processing, potentially leading to kernel crashes or information disclosure. The issues affect the shared-key authentication path in the rtl8723bs driver, which could impact devices using this driver for wireless connectivity.
Mitigation Recommendations
A fix has been applied to the Linux kernel rtl8723bs staging driver to address these vulnerabilities by adding proper length checks. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the exact fixed version and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth()… (CVE-2026-64445)
Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: length = len - WLAN_HDR_A3_LEN - iv_len and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to size_t, causes crc32_le() to read far beyond the frame buffer. Add a minimum length check before accessing the IV field and calling the decryption path. When processing a seq=3 response, rtw_get_ie() stores the Challenge Text IE length in ie_len, but the subsequent memcmp() always reads 128 bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of exactly 128 bytes; reject any IE whose length field differs, matching the check already applied to OnAuthClient().
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel rtl8723bs staging driver had two vulnerabilities in the OnAuth() function's shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() was called without verifying the frame length, leading to a length underflow and an out-of-bounds read in crc32_le(). Additionally, during processing of a seq=3 response, rtw_get_ie() stored the Challenge Text IE length but memcmp() read a fixed 128 bytes regardless of the actual length, violating IEEE 802.11 standards and causing an out-of-bounds read. The fixes add minimum length checks before accessing the IV field and enforce strict length validation on the Challenge Text IE.
Potential Impact
These vulnerabilities can cause out-of-bounds reads in kernel memory during WEP decryption and Challenge Text IE processing, potentially leading to kernel crashes or information disclosure. The issues affect the shared-key authentication path in the rtl8723bs driver, which could impact devices using this driver for wireless connectivity.
Mitigation Recommendations
A fix has been applied to the Linux kernel rtl8723bs staging driver to address these vulnerabilities by adding proper length checks. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the exact fixed version and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g74x-wr8m-rhmp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64445"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542089c2644c7f8082cdb
Added to database: 07/25/2026, 23:08:56 UTC
Last enriched: 07/25/2026, 23:20:02 UTC
Last updated: 09/08/2026, 10:52:11 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.