{"id":"CVE-2026-64441","summary":"staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()\n\nThree IE/attribute parsing functions have missing bounds checks.\n\nrtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer\nwithout verifying that the header bytes (tag + length) are within the\nremaining buffer before reading them.  Additionally, rtw_get_sec_ie()\ncompares the 4-byte WPA OUI at cnt+2 without checking that at least\n6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at\ncnt+6 without checking that at least 10 bytes remain.\n\nrtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at\nentry, before verifying that wps_ielen is large enough to contain\nthe 6-byte WPS IE header (element_id + length + 4-byte OUI).  Inside\nthe attribute loop, get_unaligned_be16() is called on attr_ptr and\nattr_ptr+2 without checking that 4 bytes remain in the buffer.\n\nAdd a cnt+2 bounds check before each loop body in rtw_get_sec_ie()\nand rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum\nIE length requirement, add a wps_ielen \u003c 6 early return in\nrtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.","modified":"2026-07-28T04:03:09.531075908Z","published":"2026-07-25T08:51:13.834Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64441.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2ea1ce30ead61589214240e8d33d96310fd613e5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4b51ee8a40fe47864197d73cc02b191de7a6b072"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/729c4e72563bda0f1725db1db9ea08df06f41d9b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b27ecba3196f6c14e3809595ebd69c0c2392512a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/efa27d487abcdec79669a60a6d94d5d6eceb7c1d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64441.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64441"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"554c0a3abf216c991c5ebddcdb2c08689ecd290b"},{"fixed":"efa27d487abcdec79669a60a6d94d5d6eceb7c1d"},{"fixed":"2ea1ce30ead61589214240e8d33d96310fd613e5"},{"fixed":"b27ecba3196f6c14e3809595ebd69c0c2392512a"},{"fixed":"6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c"},{"fixed":"4b51ee8a40fe47864197d73cc02b191de7a6b072"},{"fixed":"729c4e72563bda0f1725db1db9ea08df06f41d9b"},{"fixed":"1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64441.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64441.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}