CVE-2026-64444 (GCVE-0-2026-64444)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42
VLAI
Title
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_len. When a malicious AP sends an AssocResponse whose last IE has only one byte remaining in the frame (the element_id byte lands at pkt_len-1), the loop reads pIE->length from pframe[pkt_len], which is one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond pkt_len, silently passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past pkt_len.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 889ca6000ac7fa73457b041848fcb08e0d51b809 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 1a52a05471494546f955a58e8c170c0c796c52d5 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 0406d746574e875d8778552eb674fcfbf5330bfb (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 0970dd47726a57e52013594e9fbf667586eb3673 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 04f612dc03427e0b1ac80a2611b5ac0ba93ac446 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 7e7741c8315e4160aead00a60cdd6f81ab880717 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < f9654207e92283e0acac5d64fe5f8835383b5a23 (git)
Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "889ca6000ac7fa73457b041848fcb08e0d51b809",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "1a52a05471494546f955a58e8c170c0c796c52d5",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "0406d746574e875d8778552eb674fcfbf5330bfb",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "0970dd47726a57e52013594e9fbf667586eb3673",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "04f612dc03427e0b1ac80a2611b5ac0ba93ac446",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "7e7741c8315e4160aead00a60cdd6f81ab880717",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "f9654207e92283e0acac5d64fe5f8835383b5a23",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop\n\nThe IE parsing loop in OnAssocRsp() advances by (pIE-\u003elength + 2) each\niteration but only guards on i \u003c pkt_len. When a malicious AP sends an\nAssocResponse whose last IE has only one byte remaining in the frame\n(the element_id byte lands at pkt_len-1), the loop reads pIE-\u003elength\nfrom pframe[pkt_len], which is one byte past the allocated receive buffer.\n\nAdditionally, even when the header bytes are in bounds, pIE-\u003elength\nitself can extend the data window beyond pkt_len, silently passing a\ntruncated IE to the handler functions.\n\nAdd two guards at the top of the loop body:\n  1. Break if fewer than sizeof(*pIE) bytes remain (can\u0027t read header).\n  2. Break if the IE\u0027s declared data extends past pkt_len."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An attacker within WiFi radio range can inject a spoofed 802.11 association response to an RTL8723BS station. WiFi management-frame injection is an adjacent attack vector.\nAC:L - The malformed final IE or oversized declared IE deterministically triggers the faulty parsing, and the attacker can observe and answer an association request. No race or condition outside attacker control is required.\nPR:N - Association responses are processed before WPA or 802.1X key establishment, without credentials or capabilities. The path checks the destination and association state but does not validate the response source or BSSID.\nUI:N - Auto-connecting phones, embedded devices, and IoT systems associate or reassociate without human action. An attacker can wait for or induce an automatic reconnect.\nS:U - The vulnerable driver and affected kernel resources belong to the same security authority. No VM, sandbox, or IOMMU boundary is crossed.\nC:H - Truncated HT or WMM elements can make handlers consume up to approximately 26 bytes beyond the logical receive frame from adjacent kernel skb memory. Under the required conservative treatment of a nontrivial out-of-bounds read, confidentiality impact is High.\nI:N - This flaw performs out-of-bounds reads but provides no out-of-bounds write or control-flow primitive. The separate HT capability overwrite was already fixed in the upstream parent and is not attributed to this CVE.\nA:H - Out-of-bounds accesses in the kernel receive tasklet can produce an oops or panic on hardened or unfavorable memory layouts. An unauthenticated adjacent attacker can repeat the trigger during association or reassociation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:42:08.619Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/889ca6000ac7fa73457b041848fcb08e0d51b809"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a52a05471494546f955a58e8c170c0c796c52d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/0406d746574e875d8778552eb674fcfbf5330bfb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0970dd47726a57e52013594e9fbf667586eb3673"
        },
        {
          "url": "https://git.kernel.org/stable/c/04f612dc03427e0b1ac80a2611b5ac0ba93ac446"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e7741c8315e4160aead00a60cdd6f81ab880717"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9654207e92283e0acac5d64fe5f8835383b5a23"
        }
      ],
      "title": "staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64444",
    "datePublished": "2026-07-25T08:51:15.968Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-08-05T12:42:08.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64444",
      "date": "2026-08-09",
      "epss": "0.0028",
      "percentile": "0.20119"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:46:38.000Z",
      "cve": "CVE-2026-64444",
      "id": "msrc_CVE-2026-64444",
      "initial_release_date": "2026-07-26T01:04:16.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64444.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64444\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:29.053\",\"lastModified\":\"2026-07-27T05:16:51.200\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstaging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop\\n\\nThe IE parsing loop in OnAssocRsp() advances by (pIE-\u003elength + 2) each\\niteration but only guards on i \u003c pkt_len. When a malicious AP sends an\\nAssocResponse whose last IE has only one byte remaining in the frame\\n(the element_id byte lands at pkt_len-1), the loop reads pIE-\u003elength\\nfrom pframe[pkt_len], which is one byte past the allocated receive buffer.\\n\\nAdditionally, even when the header bytes are in bounds, pIE-\u003elength\\nitself can extend the data window beyond pkt_len, silently passing a\\ntruncated IE to the handler functions.\\n\\nAdd two guards at the top of the loop body:\\n  1. Break if fewer than sizeof(*pIE) bytes remain (can\u0027t read header).\\n  2. Break if the IE\u0027s declared data extends past pkt_len.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"889ca6000ac7fa73457b041848fcb08e0d51b809\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"1a52a05471494546f955a58e8c170c0c796c52d5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"0406d746574e875d8778552eb674fcfbf5330bfb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"0970dd47726a57e52013594e9fbf667586eb3673\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"04f612dc03427e0b1ac80a2611b5ac0ba93ac446\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"7e7741c8315e4160aead00a60cdd6f81ab880717\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"f9654207e92283e0acac5d64fe5f8835383b5a23\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/staging/rtl8723bs/core/rtw_mlme_ext.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0406d746574e875d8778552eb674fcfbf5330bfb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/04f612dc03427e0b1ac80a2611b5ac0ba93ac446\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0970dd47726a57e52013594e9fbf667586eb3673\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1a52a05471494546f955a58e8c170c0c796c52d5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7e7741c8315e4160aead00a60cdd6f81ab880717\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/889ca6000ac7fa73457b041848fcb08e0d51b809\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f9654207e92283e0acac5d64fe5f8835383b5a23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-30T04:23:02+00:00",
      "cve": "CVE-2026-64444",
      "id": "CVE-2026-64444",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64444.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.