PT-2026-64662 · Linux · Linux
CVE-2026-64441
·
Published
2026-07-25
·
Updated
2026-07-25
CVSS v3.1
8.8
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB reads in rtw get sec ie(), rtw get wapi ie(), and rtw get wps attr()
Three IE/attribute parsing functions have missing bounds checks.
rtw get sec ie() and rtw get wapi ie() iterate over a raw IE buffer
without verifying that the header bytes (tag + length) are within the
remaining buffer before reading them. Additionally, rtw get sec ie()
compares the 4-byte WPA OUI at cnt+2 without checking that at least
6 bytes remain, and rtw get wapi ie() compares a 4-byte WAPI OUI at
cnt+6 without checking that at least 10 bytes remain.
rtw get wps attr() reads wps ie[0] and wps ie+2 unconditionally at
entry, before verifying that wps ielen is large enough to contain
the 6-byte WPS IE header (element id + length + 4-byte OUI). Inside
the attribute loop, get unaligned be16() is called on attr ptr and
attr ptr+2 without checking that 4 bytes remain in the buffer.
Add a cnt+2 bounds check before each loop body in rtw get sec ie()
and rtw get wapi ie(), guard each multi-byte comparison with a minimum
IE length requirement, add a wps ielen < 6 early return in
rtw get wps attr(), and add a 4-byte bounds check in its inner loop.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux