CVE-2026-64446: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix heap buffer overflow in rtwcfg80211setwpaie()
supplicantie is a 256-byte array in struct securitypriv. The WPA and WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicantie, &pwpa[0], wpaielen + 2);
where wpaielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpaielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent lastmicerrtime field.
rtwparsewpaie() does not prevent this: its length consistency check compares (wpaie+1) against (u8)(wpaielen-2), which is (u8)(255) == 255 when wpaielen = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpaielen + 2) exceeds the supplicantie buffer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's staging rtl8723bs driver are exposed when a local user can submit wireless connection requests through nl80211. The affected code handles WPA and WPA2 information elements.
What does an attacker need to exploit it?
An attacker needs local access with sufficient privileges to supply a crafted connect request via nl80211. No user interaction is required; the crafted WPA information element uses a raw length of 255, producing a 257-byte copy into a 256-byte buffer.
Is this limited to malformed WPA information elements?
The vulnerable copy paths cover both WPA and WPA2 information elements. The existing WPA IE parser's length consistency check can accept the oversized 255-length case because of an 8-bit cast.
What mitigation is available if the fix cannot be applied immediately?
Restrict access to local users or processes that can issue nl80211 wireless connection requests, particularly for systems using the rtl8723bs staging driver. The described fix adds bounds checks that reject information elements whose total size exceeds the supplicant_ie buffer.