CVE-2026-64446
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
INFO
Published Date :
July 25, 2026, 10:17 a.m.
Last Modified :
July 25, 2026, 10:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64446
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to the latest version.
- Apply specific patches for rtl8723bs module.
- Validate WPA/WPA2 IE lengths before copying.
- Reject crafted IE exceeding buffer size.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64446.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64446 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64446
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64446 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64446 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': 'a94a643a80a84ceb8139061c3d6bf988d75e45a5', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '2131621986c62c86109ce4d84cf73a73757eb8a6', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '6f20d7b0ee47c470734a69379b0fc6647c519603', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '5d7812360abf3143afcbf5efe4ef242448fa1f28', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '46f66c16a95191d9aca07a72ae6b1252a244e26c', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': 'b9c4bf133c3c47e23baf4f5403b98a953bf58606', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '138cd190efd56ab36c9fdd8fef8749d06937f24b', 'versionType': 'git'}, {'status': 'affected', 'version': '554c0a3abf216c991c5ebddcdb2c08689ecd290b', 'lessThan': '5a752a616e756844388a1a45404db9fc29fec655', 'versionType': 'git'}], 'programFiles': ['drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer. Added Reference https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b Added Reference https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6 Added Reference https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c Added Reference https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655 Added Reference https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28 Added Reference https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603 Added Reference https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5 Added Reference https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606