CVE-2026-64443 (GCVE-0-2026-64443)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
The IE parsing loop in update_beacon_info() advances by
(pIE->length + 2) each iteration but only guards on i < len.
When a malicious AP sends a Beacon whose last IE has only one byte
remaining in the frame (the element_id byte lands at len-1), the loop
reads pIE->length from one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond len, passing a truncated IE
to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past len.
Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length
for consistency with the sizeof(*pIE) guards added above.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_wlan_util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6dd5e8c3011ebabf417257d7f07901a7c4311539",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "9193c34f75fd9e1ea8a590d7cced464c3380dc29",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "bd953d52d587d42365e399b96c52dbdb13032070",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "69f174a0673b6b7a29b851adb60bc450cdc0ecc4",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "b5cc2f999927f69723ca53f1f2a3aa37dbeda907",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "ed51de4a86e173c3b0ef78e039c2e49e08b11f16",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_wlan_util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in update_beacon_info() IE loop\n\nThe IE parsing loop in update_beacon_info() advances by\n(pIE-\u003elength + 2) each iteration but only guards on i \u003c len.\nWhen a malicious AP sends a Beacon whose last IE has only one byte\nremaining in the frame (the element_id byte lands at len-1), the loop\nreads pIE-\u003elength from one byte past the allocated receive buffer.\n\nAdditionally, even when the header bytes are in bounds, pIE-\u003elength\nitself can extend the data window beyond len, passing a truncated IE\nto the handler functions.\n\nAdd two guards at the top of the loop body:\n 1. Break if fewer than sizeof(*pIE) bytes remain (can\u0027t read header).\n 2. Break if the IE\u0027s declared data extends past len.\n\nAlso replace i += (pIE-\u003elength + 2) with i += sizeof(*pIE) + pIE-\u003elength\nfor consistency with the sizeof(*pIE) guards added above."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - An attacker within WiFi radio range can inject a crafted beacon spoofing the associated AP\u0027s BSSID. WiFi management-frame injection is an adjacent attack vector.\nAC:L - The malformed IE deterministically triggers the faulty parsing, and the attacker can send repeated beacons to satisfy the every-sixteenth-packet processing condition. No race or condition outside attacker control is required.\nPR:N - Ordinary beacon frames are not authenticated, even on WPA-protected networks. The driver checks association state, addresses, and BSSID, all of which an adjacent attacker can spoof without credentials or host privileges.\nUI:N - Once the interface is associated or operating in IBSS mode, crafted beacons are processed without victim action. Continuously connected embedded and mobile deployments provide this state automatically.\nS:U - The vulnerable driver and affected kernel resources belong to the same operating-system security authority. No guest-host, sandbox, or IOMMU boundary is crossed.\nC:H - Truncated WMM or HT elements can make handlers consume roughly 22 to 24 bytes beyond the logical frame from adjacent kernel skb memory. Under conservative treatment of this nontrivial kernel out-of-bounds read, confidentiality impact is High.\nI:N - The flaw performs out-of-bounds reads but provides no out-of-bounds write or control-flow primitive. Handler copies target correctly sized driver state fields.\nA:H - Out-of-bounds accesses in the kernel receive tasklet can produce an oops or panic on hardened or unfavorable memory layouts. An unauthenticated adjacent attacker can repeatedly transmit triggering beacons."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:45.615Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25"
},
{
"url": "https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539"
},
{
"url": "https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29"
},
{
"url": "https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070"
},
{
"url": "https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4"
},
{
"url": "https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907"
},
{
"url": "https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16"
}
],
"title": "staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64443",
"datePublished": "2026-07-25T08:51:15.234Z",
"dateReserved": "2026-07-19T15:36:31.788Z",
"dateUpdated": "2026-08-17T04:55:45.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…