CVE-2026-64441: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64441 Overview

CVE-2026-64441 is an out-of-bounds read vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. Three information element (IE) parsing functions — rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() — perform multi-byte reads on IE buffers without validating that the required bytes remain in scope. An adjacent attacker within Wi-Fi range can craft malicious beacon, probe response, or association frames that trigger reads past allocated buffer boundaries during scan or association handling.

Critical Impact
Adjacent-network attackers can trigger kernel out-of-bounds reads in Wi-Fi frame parsing, potentially leaking kernel memory, causing denial of service, or aiding in exploitation chains on systems using the rtl8723bs driver.

Affected Products

Linux kernel drivers/staging/rtl8723bs component
Linux distributions shipping the rtl8723bs staging driver for Realtek RTL8723BS SDIO Wi-Fi chipsets
Embedded and ARM devices (including single-board computers) that rely on the rtl8723bs staging driver

Discovery Timeline

2026-07-25 - CVE-2026-64441 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64441

Vulnerability Analysis

The flaw resides in three IE and attribute parsing helpers used by the rtl8723bs staging driver to inspect security-related fields in 802.11 management frames. Each helper walks a raw byte buffer that originates from over-the-air frames, but none of the three functions validates that enough bytes remain before performing multi-byte reads.

rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over an IE buffer and read the tag and length header bytes without confirming that at least two bytes remain in the buffer. rtw_get_sec_ie() then compares a 4-byte WPA Organizationally Unique Identifier (OUI) at offset cnt+2 without confirming that six bytes remain. rtw_get_wapi_ie() performs a similar comparison at offset cnt+6 without confirming that ten bytes remain.

rtw_get_wps_attr() dereferences wps_ie[0] and wps_ie+2 before validating that wps_ielen covers the 6-byte WPS IE header. Inside its attribute loop, get_unaligned_be16() is invoked on attr_ptr and attr_ptr+2 without confirming that four bytes remain.

Root Cause

The root cause is missing bounds checks in tag-length-value (TLV) parsing logic. The parsers trust attacker-controlled length fields and buffer positions instead of validating each read against the remaining buffer size. This is a classic Out-of-Bounds Read pattern in kernel network parsing code.

Attack Vector

Exploitation requires adjacent-network access — an attacker must be within Wi-Fi range of a target using the rtl8723bs driver. Crafted 802.11 frames containing malformed WPA, WAPI, or WPS information elements can trigger the driver to read past IE buffer boundaries during normal scan and association processing. No user interaction or authentication is required.

See the Linux Kernel Commit 1463ca3 and the Linux Kernel Commit efa27d4 fixes for the corrected bounds-check implementations.

Detection Methods for CVE-2026-64441

Indicators of Compromise

Kernel log entries citing faults or KASAN reports in rtw_get_sec_ie, rtw_get_wapi_ie, or rtw_get_wps_attr
Unexpected kernel oops, panic, or Wi-Fi driver crashes on devices running the rtl8723bs staging driver
Repeated malformed 802.11 beacon, probe response, or association frames observed on nearby wireless channels

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test builds to surface out-of-bounds reads in drivers/staging/rtl8723bs/core/rtw_ieee80211.c and rtw_wlan_util.c
Correlate wireless intrusion detection alerts for malformed IEs with host-side kernel crash telemetry
Inventory Linux hosts loading the r8723bs kernel module and prioritize them for patch verification

Monitoring Recommendations

Forward dmesg and journalctl -k output to a central log platform and alert on rtl8723bs faults
Monitor for repeated Wi-Fi disassociation or driver reset events on affected embedded devices
Track kernel package versions across the fleet to confirm that patched builds are deployed

How to Mitigate CVE-2026-64441

Immediate Actions Required

Update to a Linux kernel version that includes the upstream and stable-tree fixes referenced in the NVD entry
On systems that do not require Realtek RTL8723BS Wi-Fi, blacklist the r8723bs module to remove the attack surface
For embedded and IoT devices without vendor patches, restrict physical Wi-Fi proximity or disable the wireless interface until an update is available

Patch Information

Fixes are distributed across multiple stable-tree commits, including Linux Kernel Commit 1463ca3, Linux Kernel Commit 2ea1ce3, Linux Kernel Commit 4b51ee8, Linux Kernel Commit 6ab1161, Linux Kernel Commit 729c4e7, Linux Kernel Commit b27ecba, and Linux Kernel Commit efa27d4. Each commit adds explicit cnt+2 bounds checks, minimum IE length guards for multi-byte OUI comparisons, an early return when wps_ielen < 6, and a 4-byte bounds check in the WPS attribute loop.

Workarounds

Unload and blacklist the driver where wireless connectivity is not required: modprobe -r r8723bs and add blacklist r8723bs to /etc/modprobe.d/
Replace affected hardware with a Wi-Fi chipset supported by a mainline (non-staging) driver where feasible
Disable Wi-Fi scanning on systems that only need to operate on a known SSID, reducing exposure to malicious beacons and probe responses

bash

# Configuration example: blacklist the vulnerable staging driver
echo "blacklist r8723bs" | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo modprobe -r r8723bs
sudo update-initramfs -u