CVE-2026-64440: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64440 Overview

CVE-2026-64440 is an out-of-bounds write vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in the HT_caps_handler() function, which processes High Throughput (HT) Capabilities Information Elements (IEs) from 802.11 Association Response frames. The handler iterates over pIE->length bytes and writes into HT_caps.u.HT_cap[], a fixed 26-byte array. Because pIE->length is an unvalidated u8 sourced directly from over-the-air frames, a malicious access point can set the length up to 255. This produces up to 229 bytes of out-of-bounds writes into adjacent fields of struct mlme_ext_info.

Critical Impact
A malicious Wi-Fi access point within radio range can corrupt kernel memory on affected Linux systems using the rtl8723bs driver, threatening integrity and availability of the host.

Affected Products

Linux kernel staging driver rtl8723bs (RTL8723BS Wi-Fi chipset)
Linux kernel stable branches receiving the referenced backport commits
Systems shipping Realtek RTL8723BS-based Wi-Fi adapters (common in embedded and low-cost devices)

Discovery Timeline

2026-07-25 - CVE-2026-64440 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64440

Vulnerability Analysis

The HT_caps_handler() function in drivers/staging/rtl8723bs/ parses the HT Capabilities IE received in 802.11 Association Response frames. The function reads the IE's length field and uses it as the loop bound when copying capability bytes into a fixed-size destination buffer, HT_caps.u.HT_cap[], which is 26 bytes wide (the size of struct HT_caps_element).

Because the length byte is attacker-controlled and never bounded against the destination buffer size, an adversary operating a rogue access point can supply a length of up to 255. The handler will then write up to 229 bytes past the end of HT_caps.u.HT_cap[], corrupting adjacent members inside struct mlme_ext_info. Corruption of MLME state fields can result in kernel memory integrity loss, denial of service through crashes, or potential control-flow influence depending on adjacent structure layout.

Root Cause

The root cause is missing input validation on a raw over-the-air field before it is used as a memory-copy bound. This is a classic Out-of-Bounds Write [CWE-787] pattern caused by trusting a network-supplied length value. The upstream fix truncates the loop count using umin() so any IE length exceeding the destination buffer is silently ignored, preserving the pmlmeinfo->HT_caps_enable = 1 assignment for interoperability with padded IEs.

Attack Vector

Exploitation requires an attacker within Wi-Fi radio range of a target station. The attacker operates a rogue AP and induces the victim to associate with it. During association, the AP replies with a crafted Association Response frame containing an HT Capabilities IE whose length byte exceeds 26. The malformed IE is parsed by HT_caps_handler() in kernel context, triggering the out-of-bounds write. No authentication, prior compromise, or user interaction beyond typical Wi-Fi association is required. See the kernel commit references for the sanitized patch that applies umin() to the iteration bound.

Detection Methods for CVE-2026-64440

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN reports referencing HT_caps_handler or rtl8723bs in system logs (dmesg, /var/log/kern.log).
Repeated Wi-Fi disconnects or MLME state anomalies on devices using the RTL8723BS chipset.
Presence of nearby unauthorized access points broadcasting SSIDs matching corporate or trusted networks with anomalously long HT Capabilities IEs.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface out-of-bounds writes during driver fuzzing or QA.
Collect and centralize kernel ring buffer messages, alerting on stack traces containing rtl8723bs or HT_caps_handler.
Monitor wireless environments with a WIDS/WIPS for association responses containing malformed or oversized information elements.

Monitoring Recommendations

Aggregate kernel logs from Linux endpoints into a centralized log platform and build detections for crash signatures involving the staging driver.
Inventory hosts running kernels with the rtl8723bs module loaded (lsmod | grep rtl8723bs) to scope exposure.
Correlate Wi-Fi association events with subsequent kernel instability to identify potential exploitation attempts.

How to Mitigate CVE-2026-64440

Immediate Actions Required

Apply the latest stable Linux kernel update that includes the HT_caps_handler() bounds fix referenced in the upstream commits.
If patching is not immediately possible, unload the vulnerable driver with modprobe -r r8723bs on hosts that do not require the adapter.
Restrict affected devices to trusted, controlled Wi-Fi networks and avoid associating with unknown SSIDs until patched.

Patch Information

The fix has been backported to multiple stable kernel branches. Refer to the upstream commits: Kernel Commit 225b6d3f, Kernel Commit 37f642d4, Kernel Commit 6f91621f, Kernel Commit 8c872b47, Kernel Commit 918537a0, Kernel Commit bb3b942d, and Kernel Commit f8001e1a. The fix truncates the iteration count using umin() against the destination buffer size.

Workarounds

Blacklist the r8723bs kernel module on systems that do not need Realtek RTL8723BS Wi-Fi support.
Replace RTL8723BS hardware with a supported adapter that uses a maintained (non-staging) driver.
Enforce use of wired networking or vetted Wi-Fi infrastructure with rogue-AP detection until affected hosts are patched.

bash

# Blacklist the vulnerable rtl8723bs driver until the kernel is patched
echo 'blacklist r8723bs' | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo modprobe -r r8723bs
sudo update-initramfs -u