CVE-2026-64441: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB reads in rtwgetsecie(), rtwgetwapiie(), and rtwgetwpsattr()
Three IE/attribute parsing functions have missing bounds checks.
rtwgetsecie() and rtwgetwapiie() iterate over a raw IE buffer without verifying that the header bytes (tag + length) are within the remaining buffer before reading them. Additionally, rtwgetsecie() compares the 4-byte WPA OUI at cnt+2 without checking that at least 6 bytes remain, and rtwgetwapiie() compares a 4-byte WAPI OUI at cnt+6 without checking that at least 10 bytes remain.
rtwgetwpsattr() reads wpsie[0] and wpsie+2 unconditionally at entry, before verifying that wpsielen is large enough to contain the 6-byte WPS IE header (elementid + length + 4-byte OUI). Inside the attribute loop, getunalignedbe16() is called on attrptr and attrptr+2 without checking that 4 bytes remain in the buffer.
Add a cnt+2 bounds check before each loop body in rtwgetsecie() and rtwgetwapiie(), guard each multi-byte comparison with a minimum IE length requirement, add a wpsielen < 6 early return in rtwgetwpsattr(), and add a 4-byte bounds check in its inner loop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Upgrade
Upgrade
staging: rtl8723bsto a version that resolves this vulnerability.Patch fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - Configuration
In rtw_get_sec_ie(), add a cnt+2 bounds check before each loop body to ensure at least the required bytes remain before multi-byte comparisons/reads.
rtw_get_sec_ie() bounds checks (cnt+2 / loop body) = add bounds check before each loop body - Configuration
In rtw_get_sec_ie(), add a wps_ielen < 6 early return before verifying that wps_ielen is large enough to contain the 6-byte WPS IE header (element_id + length + 4-byte OUI).
rtw_get_sec_ie() IE length requirement (wps_ielen < 6) = early return when wps_ielen < 6 - Configuration
In rtw_get_wapi_ie(), guard each multi-byte comparison so that a 4-byte WAPI OUI at cnt+2 (and/or attr_ptr+2) is only compared after verifying that at least 4 bytes remain in the buffer.
rtw_get_wapi_ie() WAPI OUI comparison bounds = guard multi-byte comparison with minimum remaining bytes (attr_ptr+2 / 4 bytes remain) - Configuration
In rtw_get_wapi_ie(), add bounds checking so that reads based on cnt+6 only occur after verifying that at least 10 bytes remain in the buffer.
rtw_get_wapi_ie() WPS attribute-length/loop bounds (cnt+6 / at least 10 bytes remain) = check before reading header/attributes - Configuration
In rtw_get_wps_attr(), add a 4-byte bounds check before reading wps_ie[0] and wps_ie+2 unconditionally (the 6-byte WPS IE header includes element_id + length + 4-byte OUI).
rtw_get_wps_attr() WPS IE header bounds (wps_ie[0] and wps_ie+2) = add 4-byte bounds check for the 6-byte WPS IE header minimum access - Configuration
In the inner attribute loop of rtw_get_wps_attr(), add bounds checks to ensure the header bytes (tag + length) are within the remaining buffer before calling get_unaligned_be16() on attr_ptr, and avoid calling it without confirming sufficient bytes remain.
rtw_get_wps_attr() attribute loop bounds (tag+length / get_unaligned_be16 input) = verify header bytes (tag + length) are within remaining buffer
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64441?
The severity of CVE-2026-64441 is high, with a CVSS score of 8.8.
What does CVE-2026-64441 affect?
CVE-2026-64441 affects the Linux kernel, specifically within the rtl8723bs staging driver.
How do I fix CVE-2026-64441?
To fix CVE-2026-64441, update your Linux kernel to a version that includes the patch for this vulnerability.
What types of vulnerabilities does CVE-2026-64441 address?
CVE-2026-64441 addresses out-of-bounds read vulnerabilities in the rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() functions.
When was CVE-2026-64441 published?
CVE-2026-64441 was published on July 25, 2026.