GHSA-49PQ-8GGV-FQJQ

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:

memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);

where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.

rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.

Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-64446"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:29Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()\n\nsupplicant_ie is a 256-byte array in struct security_priv. The WPA and\nWPA2 IE copy paths use:\n\n    memcpy(padapter-\u003esecuritypriv.supplicant_ie, \u0026pwpa[0], wpa_ielen + 2);\n\nwhere wpa_ielen is the raw IE length field (u8, 0-255). When a local user\nsupplies a connect request via nl80211 with a crafted WPA IE of length 255,\nwpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into\nthe adjacent last_mic_err_time field.\n\nrtw_parse_wpa_ie() does not prevent this: its length consistency check\ncompares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255\nwhen wpa_ie_len = 257, so the check passes silently.\n\nAdd explicit bounds checks for both the WPA and WPA2 paths before the\nmemcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the\nsupplicant_ie buffer.",
  "id": "GHSA-49pq-8ggv-fqjq",
  "modified": "2026-07-25T12:31:36Z",
  "published": "2026-07-25T12:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64446"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.