CVE-2026-64440 - Vulnerability Details

- staging: rtl8723bs: fix OOB write in HT_caps_handler()

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB write in HT_caps_handler()

HT_caps_handler() iterates pIE->length bytes and writes into
HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct
HT_caps_element). Because pIE->length is a raw u8 from an over-the-air
802.11 AssocResponse frame and is never validated, a malicious AP can
set it up to 255, causing up to 229 bytes of out-of-bounds writes into
adjacent fields of struct mlme_ext_info.

Truncate the iteration count to the size of HT_caps.u.HT_cap using
umin() so that data from a longer-than-expected IE is silently ignored
rather than written out of bounds, preserving interoperability with APs
that pad the element. An early return on oversized IEs was considered
but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1
assignment that precedes the loop, silently disabling HT mode for APs
that append extra bytes to the HT Capabilities IE.

Published: 2026-07-25

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An out-of-bounds write (CWE-787) occurs in the HT_caps_handler() function of the rtl8723bs driver. The function copies a length field from an 802.11 Association Response frame, which can be set to 255 by a malicious access point, into a fixed 26-byte array. Unvalidated input leads to an uncontrolled memory buffer overflow, corrupting adjacent fields of the mlme_ext_info structure and potentially enabling arbitrary kernel memory corruption. Such a breach may allow privilege escalation or remote code execution if the attacker can control the overwritten data.

Affected Systems

All Linux kernel releases that include the rtl8723bs staging driver before the recent patch are affected. The vulnerability is present in the driver that handles wireless connectivity for devices using the rtl8723bs chipset. The patch was committed in the Linux kernel and is included in subsequent kernel releases; earlier kernels lacking this commit remain vulnerable.

Risk and Exploitability

The CVSS score is 8.1, indicating high severity. The EPSS score is under 1 % and the flaw is not listed in the CISA KEV catalog, reflecting a low likelihood of exploitation. However, the attack requires a rogue wireless access point that can broadcast crafted Association Response frames in proximity to the victim. If exploited, the vulnerability can lead to denial of service or, in the worst case, remote code execution within the kernel.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 37f642d47c3648a707df3ceb092eee1adffbfd28
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 8c872b47c7fc32e95e0da1db7512388794adcd69
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 918537a0fbed85aab61fa28ad75e6279070610c9
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 6f91621fc45025ad3c0be796b70e6e4cee22fc69
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< f8001e1a516ba3b495728c65b61f799cbfad6bd0

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,37f642d47c3648a707df3ceb092eee1adffbfd28)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,8c872b47c7fc32e95e0da1db7512388794adcd69)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,918537a0fbed85aab61fa28ad75e6279070610c9)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,6f91621fc45025ad3c0be796b70e6e4cee22fc69)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,f8001e1a516ba3b495728c65b61f799cbfad6bd0)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.12`	affected	generic	—
`[0,4.12)`	unaffected	generic	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the rtl8723bs OOB write fix (committed in the kernel repository).
If a kernel update cannot be applied immediately, unload or blacklist the rtl8723bs driver to prevent the vulnerable code from loading.
Implement wireless network hardening: enforce WPA2-Enterprise or WPA3 authentication, disable open SSIDs, and use network access controls or rogue AP detection to prevent malicious access points from connecting to the network.

Generated by OpenCVE AI on August 3, 2026 at 18:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00266.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d
https://git.kernel.org/stable/c/37f642d47c3648a707df3ceb092eee1adffbfd28
https://git.kernel.org/stable/c/6f91621fc45025ad3c0be796b70e6e4cee22fc69
https://git.kernel.org/stable/c/8c872b47c7fc32e95e0da1db7512388794adcd69
https://git.kernel.org/stable/c/918537a0fbed85aab61fa28ad75e6279070610c9
https://git.kernel.org/stable/c/bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a
https://git.kernel.org/stable/c/f8001e1a516ba3b495728c65b61f799cbfad6bd0
https://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64440-7b48@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64440
https://www.cve.org/CVERecord?id=CVE-2026-64440

History

Sun, 02 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-120

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64440-7b48@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64440 https://www.cve.org/CVERecord?id=CVE-2026-64440

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}`

Sun, 26 Jul 2026 01:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120 CWE-787

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->length bytes and writes into HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct HT_caps_element). Because pIE->length is a raw u8 from an over-the-air 802.11 AssocResponse frame and is never validated, a malicious AP can set it up to 255, causing up to 229 bytes of out-of-bounds writes into adjacent fields of struct mlme_ext_info. Truncate the iteration count to the size of HT_caps.u.HT_cap using umin() so that data from a longer-than-expected IE is silently ignored rather than written out of bounds, preserving interoperability with APs that pad the element. An early return on oversized IEs was considered but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1 assignment that precedes the loop, silently disabling HT mode for APs that append extra bytes to the HT Capabilities IE.
Title		staging: rtl8723bs: fix OOB write in HT_caps_handler()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d https://git.kernel.org/stable/c/37f642d47c3648a707df3ceb092eee1adffbfd28 https://git.kernel.org/stable/c/6f91621fc45025ad3c0be796b70e6e4cee22fc69 https://git.kernel.org/stable/c/8c872b47c7fc32e95e0da1db7512388794adcd69 https://git.kernel.org/stable/c/918537a0fbed85aab61fa28ad75e6279070610c9 https://git.kernel.org/stable/c/bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a https://git.kernel.org/stable/c/f8001e1a516ba3b495728c65b61f799cbfad6bd0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:13.138Z

Updated: 2026-08-05T12:42:04.223Z

Reserved: 2026-07-19T15:36:31.788Z

Link: CVE-2026-64440

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:28.547

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64440

Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64440 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T18:45:17Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object