---
id: CVE-2026-64441
title: >-
  staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and
  rtw_get_wps_attr()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and
  rtw_get_wps_attr()


  Three IE/attribute parsing functions have missing bounds checks.


  rtw_…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    efa27d487abcdec79669a60a6d94d5d6eceb7c1d
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    2ea1ce30ead61589214240e8d33d96310fd613e5
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    b27ecba3196f6c14e3809595ebd69c0c2392512a
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    4b51ee8a40fe47864197d73cc02b191de7a6b072
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    729c4e72563bda0f1725db1db9ea08df06f41d9b
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344
  - Linux 4.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:40:49.431069Z'
published: '2026-07-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:36.215Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64441'
references:
  - url: 'https://git.kernel.org/stable/c/efa27d487abcdec79669a60a6d94d5d6eceb7c1d'
  - url: 'https://git.kernel.org/stable/c/2ea1ce30ead61589214240e8d33d96310fd613e5'
  - url: 'https://git.kernel.org/stable/c/b27ecba3196f6c14e3809595ebd69c0c2392512a'
  - url: 'https://git.kernel.org/stable/c/6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c'
  - url: 'https://git.kernel.org/stable/c/4b51ee8a40fe47864197d73cc02b191de7a6b072'
  - url: 'https://git.kernel.org/stable/c/729c4e72563bda0f1725db1db9ea08df06f41d9b'
  - url: 'https://git.kernel.org/stable/c/1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344'
tags:
  - cve.org
epss: 0.00256
epssPercentile: 0.16129
ingestedAt: '2026-10-16T17:24:46.825Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

Three IE/attribute parsing functions have missing bounds checks.

rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer
without verifying that the header bytes (tag + length) are within the
remaining buffer before reading them.  Additionally, rtw_get_sec_ie()
compares the 4-byte WPA OUI at cnt+2 without checking that at least
6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at
cnt+6 without checking that at least 10 bytes remain.

rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at
entry, before verifying that wps_ielen is large enough to contain
the 6-byte WPS IE header (element_id + length + 4-byte OUI).  Inside
the attribute loop, get_unaligned_be16() is called on attr_ptr and
attr_ptr+2 without checking that 4 bytes remain in the buffer.

Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie()
and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum
IE length requirement, add a wps_ielen < 6 early return in
rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.

## Affected

- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < efa27d487abcdec79669a60a6d94d5d6eceb7c1d`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 2ea1ce30ead61589214240e8d33d96310fd613e5`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < b27ecba3196f6c14e3809595ebd69c0c2392512a`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 4b51ee8a40fe47864197d73cc02b191de7a6b072`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 729c4e72563bda0f1725db1db9ea08df06f41d9b`
- `Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.