CVE-2026-64441

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

Three IE/attribute parsing functions have missing bounds checks.

rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer

without verifying that the header bytes (tag + length) are within the

remaining buffer before reading them. Additionally, rtw_get_sec_ie()

compares the 4-byte WPA OUI at cnt+2 without checking that at least

6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at

cnt+6 without checking that at least 10 bytes remain.

rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at

entry, before verifying that wps_ielen is large enough to contain

the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside

the attribute loop, get_unaligned_be16() is called on attr_ptr and

attr_ptr+2 without checking that 4 bytes remain in the buffer.

Add a cnt+2 bounds check before eac

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References