CVE-2026-64443 - Vulnerability Details

- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

The IE parsing loop in update_beacon_info() advances by
(pIE->length + 2) each iteration but only guards on i < len.
When a malicious AP sends a Beacon whose last IE has only one byte
remaining in the frame (the element_id byte lands at len-1), the loop
reads pIE->length from one byte past the allocated receive buffer.

Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond len, passing a truncated IE
to the handler functions.

Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past len.

Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length
for consistency with the sizeof(*pIE) guards added above.

Published: 2026-07-25

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the rtl8723bs wireless driver causes the beacon parsing loop to process an IEEE 802.11 beacon element without properly checking that sufficient bytes remain for the header and data. When a malicious access point sends a beacon whose final element has a bad length field, the driver reads past the end of the received packet, exposing data from kernel memory or crashing the kernel. The flaw results from an out‑of‑bounds read in update_beacon_info() and enables an attacker to infer sensitive data or disrupt system operation.

Affected Systems

Linux kernel with rtl8723bs staging wireless driver (any version prior to the applied fix).

Risk and Exploitability

The CVSS score of 8.1, combined with an EPSS score below 1 % and the flaw not listed in CISA KEV, indicates a high severity but a low probability of widespread exploitation. However, the vulnerability can be triggered by a rogue Wi‑Fi access point that the target device will monitor, so a local attacker in proximity to the victim can send crafted beacon frames to read kernel memory or cause a denial of service. The risk is significant for systems that rely on rtl8723bs for wireless connectivity, especially in environments where wireless traffic is trusted.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 6dd5e8c3011ebabf417257d7f07901a7c4311539
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 9193c34f75fd9e1ea8a590d7cced464c3380dc29
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< bd953d52d587d42365e399b96c52dbdb13032070
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 69f174a0673b6b7a29b851adb60bc450cdc0ecc4
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< b5cc2f999927f69723ca53f1f2a3aa37dbeda907
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< ed51de4a86e173c3b0ef78e039c2e49e08b11f16

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,6dd5e8c3011ebabf417257d7f07901a7c4311539)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,9193c34f75fd9e1ea8a590d7cced464c3380dc29)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,bd953d52d587d42365e399b96c52dbdb13032070)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,69f174a0673b6b7a29b851adb60bc450cdc0ecc4)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,b5cc2f999927f69723ca53f1f2a3aa37dbeda907)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b,ed51de4a86e173c3b0ef78e039c2e49e08b11f16)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.12`	affected	generic	—
`[0,4.12)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to a kernel version that includes the rtl8723bs patch from the listed commits
If an immediate kernel upgrade is not feasible, apply the local patch to rtl8723bs as referenced in the commit log
Disabling or limiting wireless functionality on the device until the driver is fixed to reduce the attack surface

Generated by OpenCVE AI on August 2, 2026 at 12:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0028.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25
https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4
https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539
https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29
https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907
https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070
https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16
https://lore.kernel.org/linux-cve-announce/2026072539-CVE-2026-64443-04dd@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64443
https://www.cve.org/CVERecord?id=CVE-2026-64443

History

Sat, 01 Aug 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-129

Thu, 30 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072539-CVE-2026-64443-04dd@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64443 https://www.cve.org/CVERecord?id=CVE-2026-64443

Mon, 27 Jul 2026 05:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-129

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past len. Also replace i += (pIE->length + 2) with i += sizeof(pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.
Title		staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25 https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4 https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539 https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29 https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907 https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070 https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:15.234Z

Updated: 2026-08-05T12:42:07.543Z

Reserved: 2026-07-19T15:36:31.788Z

Link: CVE-2026-64443

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:28.930

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64443

Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64443 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T12:45:06Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object