CVE-2026-64442

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Two IE parsing loops are missing the header bounds checks before they

dereference pIE->length:

- issue_assocreq() walks pmlmeinfo->network.ies to build the

association request. If the stored IE data ends with only an

element_id byte and no length byte, pIE->length is read one byte

past the end of the buffer.

- join_cmd_hdl() walks pnetwork->ies during station join and has

the same problem under the same conditions.

Both buffers are filled from AP beacon and probe-response frames, so a

malicious AP that sends a truncated final IE can trigger the issue.

Apply the two-guard pattern established in update_beacon_info():

1. Break if fewer than sizeof(*pIE) bytes remain.

2. Break if the IE's declared data extends past the buffer end.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References