CVE-2026-64536: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 6.6.145.2-1
2. Configuration

   In the IE iteration loop, before reading pIE->element_id or pIE->length, verify bounds (i + sizeof(*pIE) <= ie_length). For WLAN_EID_VENDOR_SPECIFIC, require pIE->length >= 12 before comparing pIE->data + 12.

   is_ap_in_tkip() WLAN_EID_VENDOR_SPECIFIC IE parsing bounds = Guard each IE dereference with i + sizeof(*pIE) <= ie_length and ensure pIE->length >= 12 before using pIE->data + 12
3. Configuration

   For WLAN_EID_RSN comparisons that access pIE->data + 8, add a guard to ensure pIE->length >= 16 (as required by this fix) so truncated IEs at the end of the buffer cannot cause OOB reads.

   is_ap_in_tkip() WLAN_EID_RSN IE parsing bounds = Require pIE->length >= 16 before using pIE->data + 8

Event History

Frequently Asked Questions