CVE-2026-64443 (GCVE-0-2026-64443)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42
VLAI
Title
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past len. Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6dd5e8c3011ebabf417257d7f07901a7c4311539 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 9193c34f75fd9e1ea8a590d7cced464c3380dc29 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < bd953d52d587d42365e399b96c52dbdb13032070 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 69f174a0673b6b7a29b851adb60bc450cdc0ecc4 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < b5cc2f999927f69723ca53f1f2a3aa37dbeda907 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < ed51de4a86e173c3b0ef78e039c2e49e08b11f16 (git)
Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_wlan_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "6dd5e8c3011ebabf417257d7f07901a7c4311539",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "9193c34f75fd9e1ea8a590d7cced464c3380dc29",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "bd953d52d587d42365e399b96c52dbdb13032070",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "69f174a0673b6b7a29b851adb60bc450cdc0ecc4",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "b5cc2f999927f69723ca53f1f2a3aa37dbeda907",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "ed51de4a86e173c3b0ef78e039c2e49e08b11f16",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_wlan_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in update_beacon_info() IE loop\n\nThe IE parsing loop in update_beacon_info() advances by\n(pIE-\u003elength + 2) each iteration but only guards on i \u003c len.\nWhen a malicious AP sends a Beacon whose last IE has only one byte\nremaining in the frame (the element_id byte lands at len-1), the loop\nreads pIE-\u003elength from one byte past the allocated receive buffer.\n\nAdditionally, even when the header bytes are in bounds, pIE-\u003elength\nitself can extend the data window beyond len, passing a truncated IE\nto the handler functions.\n\nAdd two guards at the top of the loop body:\n  1. Break if fewer than sizeof(*pIE) bytes remain (can\u0027t read header).\n  2. Break if the IE\u0027s declared data extends past len.\n\nAlso replace i += (pIE-\u003elength + 2) with i += sizeof(*pIE) + pIE-\u003elength\nfor consistency with the sizeof(*pIE) guards added above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An attacker within WiFi radio range can inject a crafted beacon spoofing the associated AP\u0027s BSSID. WiFi management-frame injection is an adjacent attack vector.\nAC:L - The malformed IE deterministically triggers the faulty parsing, and the attacker can send repeated beacons to satisfy the every-sixteenth-packet processing condition. No race or condition outside attacker control is required.\nPR:N - Ordinary beacon frames are not authenticated, even on WPA-protected networks. The driver checks association state, addresses, and BSSID, all of which an adjacent attacker can spoof without credentials or host privileges.\nUI:N - Once the interface is associated or operating in IBSS mode, crafted beacons are processed without victim action. Continuously connected embedded and mobile deployments provide this state automatically.\nS:U - The vulnerable driver and affected kernel resources belong to the same operating-system security authority. No guest-host, sandbox, or IOMMU boundary is crossed.\nC:H - Truncated WMM or HT elements can make handlers consume roughly 22 to 24 bytes beyond the logical frame from adjacent kernel skb memory. Under conservative treatment of this nontrivial kernel out-of-bounds read, confidentiality impact is High.\nI:N - The flaw performs out-of-bounds reads but provides no out-of-bounds write or control-flow primitive. Handler copies target correctly sized driver state fields.\nA:H - Out-of-bounds accesses in the kernel receive tasklet can produce an oops or panic on hardened or unfavorable memory layouts. An unauthenticated adjacent attacker can repeatedly transmit triggering beacons."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:42:07.543Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539"
        },
        {
          "url": "https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070"
        },
        {
          "url": "https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16"
        }
      ],
      "title": "staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64443",
    "datePublished": "2026-07-25T08:51:15.234Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-08-05T12:42:07.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64443",
      "date": "2026-08-09",
      "epss": "0.0028",
      "percentile": "0.2012"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:41:58.000Z",
      "cve": "CVE-2026-64443",
      "id": "msrc_CVE-2026-64443",
      "initial_release_date": "2026-07-26T01:11:26.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64443.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64443\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:28.930\",\"lastModified\":\"2026-07-27T05:16:51.063\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstaging: rtl8723bs: fix OOB read in update_beacon_info() IE loop\\n\\nThe IE parsing loop in update_beacon_info() advances by\\n(pIE-\u003elength + 2) each iteration but only guards on i \u003c len.\\nWhen a malicious AP sends a Beacon whose last IE has only one byte\\nremaining in the frame (the element_id byte lands at len-1), the loop\\nreads pIE-\u003elength from one byte past the allocated receive buffer.\\n\\nAdditionally, even when the header bytes are in bounds, pIE-\u003elength\\nitself can extend the data window beyond len, passing a truncated IE\\nto the handler functions.\\n\\nAdd two guards at the top of the loop body:\\n  1. Break if fewer than sizeof(*pIE) bytes remain (can\u0027t read header).\\n  2. Break if the IE\u0027s declared data extends past len.\\n\\nAlso replace i += (pIE-\u003elength + 2) with i += sizeof(*pIE) + pIE-\u003elength\\nfor consistency with the sizeof(*pIE) guards added above.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/staging/rtl8723bs/core/rtw_wlan_util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"6dd5e8c3011ebabf417257d7f07901a7c4311539\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"9193c34f75fd9e1ea8a590d7cced464c3380dc29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"bd953d52d587d42365e399b96c52dbdb13032070\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"69f174a0673b6b7a29b851adb60bc450cdc0ecc4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"b5cc2f999927f69723ca53f1f2a3aa37dbeda907\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"ed51de4a86e173c3b0ef78e039c2e49e08b11f16\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/staging/rtl8723bs/core/rtw_wlan_util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-30T09:52:12+00:00",
      "cve": "CVE-2026-64443",
      "id": "CVE-2026-64443",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64443.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.