CVE-2026-64442: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq() and joincmdhdl()
Two IE parsing loops are missing the header bounds checks before they dereference pIE->length:
- issueassocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an elementid byte and no length byte, pIE->length is read one byte past the end of the buffer.
- joincmdhdl() walks pnetwork->ies during station join and has the same problem under the same conditions.
Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue.
Apply the two-guard pattern established in updatebeaconinfo(): 1. Break if fewer than sizeof(pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's staging rtl8723bs driver are exposed when they process beacon or probe-response frames from a wireless access point. The vulnerable parsing paths handle stored information elements while building an association request or processing a station join.
What does an attacker need to exploit it?
An attacker needs to operate or impersonate a nearby malicious access point capable of sending a beacon or probe-response frame with a truncated final information element. No privileges or user interaction are required; the CVSS vector identifies adjacent-network attack access.
Is a normal access point required to trigger the issue?
No. The malformed frame condition is specifically a final information element containing only an element ID byte, without the following length byte. The issue can also occur when an element's declared data length extends beyond the received buffer.
What should be done if patching cannot happen immediately?
The provided data identifies a malicious AP as the trigger source. Until the patch is applied, reducing exposure to untrusted or potentially rogue nearby wireless access points limits the identified attack condition.