CVE-2026-64441

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Three Information Element (IE) and attribute parsing functions in the rtl8723bs staging driver contain missing bounds checks, leading to out-of-bounds reads. The functions rtw get sec ie() and rtw get wapi ie() iterate over a raw IE buffer without verifying if the header bytes are within the remaining buffer. Specifically, rtw get sec ie() compares a 4-byte WPA OUI at cnt+2 without ensuring 6 bytes remain, and rtw get wapi ie() compares a 4-byte WAPI OUI at cnt+6 without ensuring 10 bytes remain. Additionally, rtw get wps attr() reads wps ie[0] and wps ie+2 before verifying if wps ielen is sufficient for the 6-byte WPS IE header. Within its attribute loop, get unaligned be16() is called on attr ptr and attr ptr+2 without confirming that 4 bytes remain in the buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.