CVE-2026-64445

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

OnAuth() has two bugs in the shared-key authentication path.

When the Privacy bit is set, rtw_wep_decrypt() is called without

verifying that the frame is long enough to contain a valid WEP IV and

ICV. Inside rtw_wep_decrypt(), length is computed as:

length = len - WLAN_HDR_A3_LEN - iv_len

and then passed as (length - 4) to crc32_le(). If len is less than

WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative

and, after the implicit cast to size_t, causes crc32_le() to read far

beyond the frame buffer. Add a minimum length check before accessing

the IV field and calling the decryption path.

When processing a seq=3 response, rtw_get_ie() stores the Challenge

Text IE length in ie_len, but the subsequent memcmp() always reads 128

bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of

exactly 128 bytes; reject an

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References