High 8.1Published Jul 25, 2026

CVE-2026-64442staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Updated under an hour ago (Oct 26, 2026, 5:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer. - join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions. Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue. Apply the two-guard pattern established in update_beacon_info(): 1. Break if fewer than sizeof(*pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before bc881c9915c4468747d0ca5fd1abd7b313cfb0f4; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 605ebd94d0f469204f3c9f2f84acc71e43e2780f; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before a830bdc82461353bf7b1f8a2ad2689bf5d2de444; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 4c21eec80cf502d9ea18e0b946246b2376452786; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before c38d16b1ffac385c9e4b38447cd5c46af1114b58; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 402f13ec95945f34a210b28df1f8740d3d4a58c5; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before ef61d628dfad38fead1fd2e08979ae9126d011d5	CNA record
linux linux_kernel linux:linux_kernel	from 4.12 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 7.2; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/bc881c9915c4468747d0ca5fd1abd7b313cfb0f4	patch
https://git.kernel.org/stable/c/605ebd94d0f469204f3c9f2f84acc71e43e2780f	patch
https://git.kernel.org/stable/c/a830bdc82461353bf7b1f8a2ad2689bf5d2de444	patch
https://git.kernel.org/stable/c/4c21eec80cf502d9ea18e0b946246b2376452786	patch
https://git.kernel.org/stable/c/ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e	patch
https://git.kernel.org/stable/c/c38d16b1ffac385c9e4b38447cd5c46af1114b58	patch
https://git.kernel.org/stable/c/402f13ec95945f34a210b28df1f8740d3d4a58c5	patch
https://git.kernel.org/stable/c/ef61d628dfad38fead1fd2e08979ae9126d011d5	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.