PT-2026-64667 · Linux · Linux
CVE-2026-64446
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix heap buffer overflow in rtw cfg80211 set wpa ie()
supplicant ie is a 256-byte array in struct security priv. The WPA and
WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant ie, &pwpa[0], wpa ielen + 2);
where wpa ielen is the raw IE length field (u8, 0-255). When a local user
supplies a connect request via nl80211 with a crafted WPA IE of length 255,
wpa ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into
the adjacent last mic err time field.
rtw parse wpa ie() does not prevent this: its length consistency check
compares *(wpa ie+1) against (u8)(wpa ie len-2), which is (u8)(255) == 255
when wpa ie len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the
memcpy, rejecting any IE whose total size (wpa ielen + 2) exceeds the
supplicant ie buffer.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux