CVE-2026-64446 - Vulnerability Details

- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

supplicant_ie is a 256-byte array in struct security_priv. The WPA and
WPA2 IE copy paths use:

memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);

where wpa_ielen is the raw IE length field (u8, 0-255). When a local user
supplies a connect request via nl80211 with a crafted WPA IE of length 255,
wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into
the adjacent last_mic_err_time field.

rtw_parse_wpa_ie() does not prevent this: its length consistency check
compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255
when wpa_ie_len = 257, so the check passes silently.

Add explicit bounds checks for both the WPA and WPA2 paths before the
memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the
supplicant_ie buffer.

Published: 2026-07-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the Linux kernel’s staging driver rtl8723bs. During a wireless connection setup, a user can supply a WPA Information Element crafted to 255 bytes. The driver copies the IE data plus a 2–byte header into a 256‑byte buffer using memcpy, which writes 257 bytes and overflows the buffer by one byte into an adjacent field. This overflow can corrupt control data on the heap and, if properly exploited, could lead to arbitrary code execution or compromise system integrity.

Affected Systems

All Linux kernel versions that include the staging rtl8723bs wireless driver are affected. The issue is specific to this driver and does not impact other wireless drivers.

Risk and Exploitability

The EPSS score is below 1 %, indicating a low current exploitation probability, and the vulnerability is not listed in CISA KEV. The flaw is a classic heap buffer overflow (CWE‑120) that requires the ability to issue an nl80211 command—typically a local user or process with sufficient privileges. Absent a disclosed CVSS score, the nature of the overflow suggests high severity when triggered.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< a94a643a80a84ceb8139061c3d6bf988d75e45a5
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 2131621986c62c86109ce4d84cf73a73757eb8a6
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 6f20d7b0ee47c470734a69379b0fc6647c519603
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 5d7812360abf3143afcbf5efe4ef242448fa1f28
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 46f66c16a95191d9aca07a72ae6b1252a244e26c
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< b9c4bf133c3c47e23baf4f5403b98a953bf58606
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 138cd190efd56ab36c9fdd8fef8749d06937f24b
`554c0a3abf216c991c5ebddcdb2c08689ecd290b`	affected	< 5a752a616e756844388a1a45404db9fc29fec655

Linux

affected

Version	Status	Constraints
`4.12`	affected	—
`0`	unaffected	< 4.12
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b, a94a643a80a84ceb8139061c3d6bf988d75e45a5)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b, 2131621986c62c86109ce4d84cf73a73757eb8a6)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b, 6f20d7b0ee47c470734a69379b0fc6647c519603)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b, 5d7812360abf3143afcbf5efe4ef242448fa1f28)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b, 46f66c16a95191d9aca07a72ae6b1252a244e26c)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b, b9c4bf133c3c47e23baf4f5403b98a953bf58606)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b, 138cd190efd56ab36c9fdd8fef8749d06937f24b)`	affected	code_commit	—
`[554c0a3abf216c991c5ebddcdb2c08689ecd290b, 5a752a616e756844388a1a45404db9fc29fec655)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.12`	affected	semver	—
`[0,4.12)`	unaffected	semver	—
`[5.10.261,6.0.0)`	unaffected	semver	—
`[5.15.212,6.0.0)`	unaffected	semver	—
`[6.1.178,7.0.0)`	unaffected	semver	—
`[6.6.145,7.0.0)`	unaffected	semver	—
`[6.12.96,7.0.0)`	unaffected	semver	—
`[6.18.39,7.0.0)`	unaffected	semver	—
`[7.1.4,8.0.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that contains the commit adding bounds checks (e.g., the patch referenced in commit 138cd190efd56ab36c9fdd8fef8749d06937f24b).
If a kernel update is unavailable, prevent the vulnerable driver from loading by adding "blacklist rtl8723bs" to /etc/modprobe.d/blacklist.conf and rebooting the system.
If the distribution does not provide the patch, manually apply the commit 138cd190efd56ab36c9fdd8fef8749d06937f24b to your kernel source, rebuild, and install the updated kernel.

Generated by OpenCVE AI on August 5, 2026 at 00:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00195.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b
https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6
https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c
https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655
https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28
https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603
https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5
https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606
https://lore.kernel.org/linux-cve-announce/2026072540-CVE-2026-64446-f81d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64446
https://www.cve.org/CVERecord?id=CVE-2026-64446

History

Tue, 04 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122

Mon, 03 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120
References		https://lore.kernel.org/linux-cve-announce/2026072540-CVE-2026-64446-f81d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64446 https://www.cve.org/CVERecord?id=CVE-2026-64446
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
Title		staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6 https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655 https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28 https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603 https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5 https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:17.402Z

Updated: 2026-07-25T08:51:17.402Z

Reserved: 2026-07-19T15:36:31.788Z

Link: CVE-2026-64446

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:29.310

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64446

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64446 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-05T00:30:05Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object