CVE-2026-64440

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write exists in the HT caps handler() function within the rtl8723bs staging driver. The function iterates based on the pIE->length variable, which is obtained from an over-the-air 802.11 AssocResponse frame. Since pIE->length is not validated, a malicious access point can set this value up to 255, leading to up to 229 bytes being written beyond the fixed 26-byte HT caps.u.HT cap[] array into adjacent fields of the mlme ext info structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.