CVE-2026-64446: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

High 7.8 EPSS 0.1% Linux kernel

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.

• CVE-2026-64446CVE identifier
• 7.8CVSS 3.1 base score (high)
• 0.1%EPSS: chance of exploitation in the next 30 days (higher than 4% of CVEs)
• 2026-07-25published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before a94a643a80a84ceb8139061c3d6bf988d75e45a5
• Linux Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 2131621986c62c86109ce4d84cf73a73757eb8a6
• Linux Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 6f20d7b0ee47c470734a69379b0fc6647c519603
• Linux Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 5d7812360abf3143afcbf5efe4ef242448fa1f28
• Linux Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 46f66c16a95191d9aca07a72ae6b1252a244e26c
• Linux Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before b9c4bf133c3c47e23baf4f5403b98a953bf58606
• Linux Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 138cd190efd56ab36c9fdd8fef8749d06937f24b
• Linux Linux 554c0a3abf216c991c5ebddcdb2c08689ecd290b to before 5a752a616e756844388a1a45404db9fc29fec655
• Linux Linux 4.12

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt install --only-upgrade linux-image-amd64

sudo apt update
sudo apt install --only-upgrade linux-image-generic (or the installed flavour: linux-image-aws, -azure, -gcp, -virtual)

sudo dnf upgrade --refresh kernel

sudo dnf upgrade --refresh kernel

sudo zypper refresh
sudo zypper update kernel-default

sudo dnf upgrade --releasever=latest kernel kernel6.12

sudo pacman -Syu

apk update && apk upgrade linux-lts linux-virt

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

Sources

• https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5
• https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6
• https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603
• https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28
• https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c
• https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606
• https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b
• https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655
• CVE-2026-64446 on CVE.org
• CVE-2026-64446 on NVD

Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.