CVE-2026-64444

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the OnAssocRsp() function within the rtl8723bs staging driver. The Information Element (IE) parsing loop advances by pIE->length + 2 per iteration but only checks if the index i is less than pkt len. A malicious Access Point can trigger this by sending an AssocResponse where the last IE has only one byte remaining in the frame, causing the loop to read pIE->length from one byte beyond the allocated receive buffer. Furthermore, the pIE->length value can extend the data window beyond pkt len, resulting in truncated IEs being passed to handler functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.