CVE-2026-64443: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64443 Overview

CVE-2026-64443 is an out-of-bounds read vulnerability in the Linux kernel rtl8723bs staging Wi-Fi driver. The flaw resides in the Information Element (IE) parsing loop within update_beacon_info(). The loop advances by pIE->length + 2 each iteration but only checks i < len before reading the next IE header. A malicious access point can craft a Beacon frame whose final IE places the element_id byte at len-1, causing the kernel to read pIE->length from memory one byte past the allocated receive buffer. Additionally, a valid header can declare a length field that extends the IE data window beyond the frame boundary, passing truncated data to downstream handlers.

Critical Impact
An attacker within Wi-Fi range can send a malicious Beacon frame to trigger an out-of-bounds read in kernel memory, potentially causing a kernel crash (denial of service) or leaking adjacent kernel memory contents.

Affected Products

Linux kernel drivers/staging/rtl8723bs wireless driver
Systems using Realtek RTL8723BS SDIO Wi-Fi chipsets
Multiple stable kernel branches (see referenced kernel.org commits for fixed versions)

Discovery Timeline

2026-07-25 - CVE-2026-64443 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64443

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the IEEE 802.11 Beacon frame parser inside the rtl8723bs staging driver. When the driver processes a received Beacon, update_beacon_info() walks the variable-length IE list embedded in the management frame body. Each IE begins with a two-byte header consisting of element_id and length, followed by length bytes of payload.

The parsing loop increments the index i by pIE->length + 2 per iteration and only verifies i < len before dereferencing the next IE pointer. When the final IE header lands with just one byte remaining in the buffer, the loop still enters, dereferences pIE->length at offset len, and reads one byte outside the allocated receive buffer. A second variant of the bug occurs when the header bytes are in range but the declared length extends past the end of the frame, causing the handler to consume truncated or attacker-controlled adjacent memory as IE payload.

Root Cause

The root cause is missing bounds validation before dereferencing IE header fields. The loop condition i < len guarantees only that the element_id byte is in range, not that the full sizeof(*pIE) header fits or that pIE->length bytes of data follow. This is a classic boundary condition error in variable-length TLV parsing.

Attack Vector

Exploitation requires the attacker to be within Wi-Fi transmission range of a target system using an RTL8723BS-based adapter with the vulnerable staging driver loaded. The attacker operates a rogue or spoofed access point that broadcasts crafted Beacon frames. No authentication, association, or user interaction is required because Beacon frames are processed as part of normal scanning. Successful exploitation can crash the kernel or, depending on memory layout, leak adjacent kernel heap contents to the attacker via subsequent driver behavior.

The upstream fix adds two guards at the top of the loop body: it breaks if fewer than sizeof(*pIE) bytes remain (so the header cannot be fully read), and breaks if i + sizeof(*pIE) + pIE->length > len (so the declared payload cannot extend past the frame). The increment is also normalized to i += sizeof(*pIE) + pIE->length for consistency with the header size check.

Detection Methods for CVE-2026-64443

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN out-of-bounds read reports referencing update_beacon_info or the rtl8723bs module in dmesg and /var/log/kern.log.
Repeated Wi-Fi driver crashes or interface resets on hosts using RTL8723BS adapters, particularly in environments where unknown access points are broadcasting.
Presence of unusual or malformed Beacon frames in captured 802.11 traffic, especially frames whose trailing IE length fields exceed the frame body size.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test builds to surface the exact out-of-bounds read at update_beacon_info() when exposed to malformed Beacons.
Correlate kernel module load events for r8723bs with subsequent kernel error logs to identify vulnerable hosts still running unpatched staging drivers.
Monitor wireless intrusion detection systems (WIDS) for Beacon frames with malformed IE length fields or truncated tag lengths.

Monitoring Recommendations

Forward kernel logs and dmesg output to a centralized log platform and alert on BUG:, KASAN:, or oops entries containing rtl8723bs or update_beacon_info.
Track kernel package versions across the fleet and flag hosts running kernels older than the fixed commits referenced by kernel.org.
Inventory endpoints using Realtek RTL8723BS chipsets (common in embedded and low-cost ARM devices) so remediation can be prioritized on exposed assets.

How to Mitigate CVE-2026-64443

Immediate Actions Required

Update the Linux kernel to a version that includes one of the fix commits: 5e8db4c, 69f174a, 6dd5e8c, 9193c34, b5cc2f9, bd953d5, or ed51de4a from the stable tree.
If patching is not immediately possible, unload the r8723bs module (modprobe -r r8723bs) and blacklist it on systems that do not require the driver.
Prefer wired connectivity or a non-vulnerable Wi-Fi adapter on affected hosts until the kernel is updated.

Patch Information

The fix was merged across multiple stable branches and is available in the following upstream commits: Linux Kernel Commit 5e8db4c, Linux Kernel Commit 69f174a, Linux Kernel Commit 6dd5e8c, Linux Kernel Commit 9193c34, Linux Kernel Commit b5cc2f9, Linux Kernel Commit bd953d5, and Linux Kernel Commit ed51de4a. The patch adds explicit header-size and declared-length bounds checks before dereferencing each IE and normalizes the loop increment.

Workarounds

Blacklist the r8723bs kernel module by adding blacklist r8723bs to /etc/modprobe.d/blacklist-rtl8723bs.conf and rebuilding the initramfs.
Disable Wi-Fi entirely on affected devices in high-risk environments where a rogue AP could be operated within range.
Replace RTL8723BS adapters with hardware supported by a mainline (non-staging) driver where feasible.

bash

# Configuration example: blacklist the vulnerable driver until patching
echo 'blacklist r8723bs' | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo modprobe -r r8723bs
sudo update-initramfs -u