CVE-2026-64442: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64442 Overview

CVE-2026-64442 is an out-of-bounds read vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in two Information Element (IE) parsing loops inside issue_assocreq() and join_cmd_hdl(). Both loops dereference pIE->length without first validating that a full IE header remains in the buffer. When a truncated final IE ends with only an element_id byte, the length read occurs one byte past the buffer boundary.

The IE buffers are populated from access point beacon and probe-response frames. A malicious AP within radio range can craft a truncated IE to trigger the read. This affects wireless clients using the RTL8723BS chipset on vulnerable kernels.

Critical Impact
An adjacent-network attacker operating a malicious AP can trigger out-of-bounds reads in kernel memory, potentially causing kernel crashes and denial of service on connecting clients.

Affected Products

Linux kernel — drivers/staging/rtl8723bs wireless driver
Systems using Realtek RTL8723BS Wi-Fi chipsets (common on low-cost SBCs and tablets)
Multiple stable kernel branches prior to the fix commits listed by kernel.org

Discovery Timeline

2026-07-25 - CVE-2026-64442 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64442

Vulnerability Analysis

The rtl8723bs driver parses 802.11 Information Elements stored in pmlmeinfo->network.ies and pnetwork->ies. Each IE follows a tag-length-value layout where the first byte is element_id and the second byte is length. The vulnerable loops in issue_assocreq() and join_cmd_hdl() iterate through these buffers and read pIE->length before confirming that at least sizeof(*pIE) bytes remain.

When the buffer terminates after a lone element_id byte, the code reads the length field from memory immediately following the allocation. This out-of-bounds read [CWE-125] can leak adjacent kernel data into subsequent processing paths, corrupt loop state, or trigger a kernel oops depending on memory layout and hardened usercopy configuration.

Root Cause

The root cause is missing header bounds checks in two IE traversal loops. The driver already established a safe two-guard pattern in update_beacon_info(): first verify that at least sizeof(*pIE) bytes remain before dereferencing, then verify that the declared IE data does not extend past the buffer end. Neither guard was applied in issue_assocreq() or join_cmd_hdl(), so a truncated trailing IE bypasses all validation.

Attack Vector

Exploitation requires an attacker within wireless range of a target client. The attacker operates a rogue AP that emits crafted beacon or probe-response frames containing a truncated final IE. When the victim client processes those frames during association or join operations, the kernel executes the vulnerable parsing loop and performs the out-of-bounds read. No authentication or user interaction is required beyond normal Wi-Fi scanning and association behavior.

No public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream kernel commits referenced by kernel.org, including Kernel Git Commit 402f13e and Kernel Git Commit ef61d62.

Detection Methods for CVE-2026-64442

Indicators of Compromise

Kernel oops or panic messages referencing issue_assocreq or join_cmd_hdl in dmesg
KASAN reports flagging out-of-bounds reads in drivers/staging/rtl8723bs
Repeated wireless disassociation or driver reset events on RTL8723BS-equipped hosts
Presence of nearby unknown APs broadcasting malformed beacon or probe-response frames

Detection Strategies

Enable KASAN on test kernels to surface the out-of-bounds read during Wi-Fi association testing
Monitor kernel logs for driver faults associated with rtl8723bs IE parsing paths
Inspect 802.11 packet captures for beacon or probe-response frames with truncated trailing IEs

Monitoring Recommendations

Forward kernel logs from Linux endpoints to a centralized logging platform for anomaly review
Track kernel version inventory to identify hosts still running unpatched rtl8723bs builds
Alert on unexpected wireless driver crashes or repeated reassociation loops on affected devices

How to Mitigate CVE-2026-64442

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix commits listed on kernel.org
Identify hosts using the rtl8723bs driver by inspecting lsmod and /sys/class/net/*/device/driver output
Restrict wireless clients to trusted SSIDs and avoid open networks in high-risk environments until patched

Patch Information

The upstream fix applies the same two-guard pattern used in update_beacon_info() to both issue_assocreq() and join_cmd_hdl(). The loops now break if fewer than sizeof(*pIE) bytes remain and break again if the declared IE data extends past the buffer end. Backports are available across multiple stable branches, including Kernel Git Commit 4c21eec, Kernel Git Commit 605ebd9, Kernel Git Commit a830bdc, Kernel Git Commit ad2637c, Kernel Git Commit bc881c9, and Kernel Git Commit c38d16b.

Workarounds

Unload the driver with modprobe -r r8723bs on hosts that do not require the RTL8723BS radio
Blacklist the module by adding blacklist r8723bs to /etc/modprobe.d/ on affected systems
Disable Wi-Fi scanning and association when operating in untrusted radio environments

bash

# Configuration example
# Blacklist the rtl8723bs staging driver until the kernel is patched
echo 'blacklist r8723bs' | sudo tee /etc/modprobe.d/blacklist-r8723bs.conf
sudo modprobe -r r8723bs
sudo update-initramfs -u