CVE-2026-64442 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
A malicious access point can trigger out-of-bounds reads in the rtl8723bs Wi-Fi driver, potentially leaking memory or causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64442?
CVE-2026-64442 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
Two IE parsing loops are missing the header bounds checks before they dereference pIE->length:
- issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer.
- join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions.
Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue.
Apply the two-guard pattern established in update_beacon_info(): 1. Break if fewer than sizeof(*pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.
Weakness: CWE-125
Which versions are affected by CVE-2026-64442?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64442?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64442 being exploited?
There is no known exploitation of CVE-2026-64442 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64442, DEBIAN-CVE-2026-64442, GHSA-9c3c-vw6j-5852, ROOT-OS-DEBIAN-12-CVE-2026-64442, ROOT-OS-UBUNTU-2204-CVE-2026-64442, UBUNTU-CVE-2026-64442.