CVE-2026-64445

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The OnAuth() function in the rtl8723bs staging driver contains two issues in the shared-key authentication path. First, when the Privacy bit is set, rtw wep decrypt() is called without verifying if the frame is long enough to contain a valid WEP IV and ICV. This can lead to a length underflow where a negative value is cast to size t, causing the crc32 le() function to perform an out-of-bounds read beyond the frame buffer. Second, when processing a seq=3 response, the rtw get ie() function stores the Challenge Text IE length in ie len, but a subsequent memcmp() operation reads 128 bytes regardless of the actual ie len value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.