CVE-2026-64536 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
Out-of-bounds reads in the rtl8723bs Wi-Fi driver allow attackers to cause denial of service or leak kernel memory via crafted Information Elements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64536?
CVE-2026-64536 is a high-severity memory corruption vulnerability in Linux, published on 27 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload:
- pIE->element_id and pIE->length are read without checking that i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the buffer causes an OOB read.
- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12, which requires pIE->length >= 16. For WLAN_EID_RSN it compares pIE->data + 8, requiring pIE->length >= 12. Neither requirement is checked.
Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE->length minimum, matching the pattern established in update_beacon_info().
Weakness: CWE-125
Which versions are affected by CVE-2026-64536?
How do I fix CVE-2026-64536?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64536 being exploited?
There is no known exploitation of CVE-2026-64536 in the wild and no public exploit code.
Sources
Also known as AZL-93959, BELL-CVE-2026-64536, DEBIAN-CVE-2026-64536, GHSA-rwmp-xmg8-8r93, ROOT-OS-DEBIAN-12-CVE-2026-64536, UBUNTU-CVE-2026-64536.