CVE-2026-64444: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64444 Overview

CVE-2026-64444 is an out-of-bounds read vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in the Information Element (IE) parsing loop within OnAssocRsp(), which processes 802.11 association response frames. The loop advances by (pIE->length + 2) each iteration but only checks i < pkt_len, allowing reads past the end of the allocated receive buffer when a malicious access point sends a crafted AssocResponse frame. An adjacent-network attacker operating a rogue AP can trigger the condition to read kernel memory beyond the receive buffer or pass truncated IEs to downstream handlers.

Critical Impact
A malicious Wi-Fi access point within radio range can trigger a kernel out-of-bounds read, leading to information disclosure or denial of service on systems using the rtl8723bs driver.

Affected Products

Linux kernel staging/rtl8723bs wireless driver
Linux distributions shipping the Realtek RTL8723BS SDIO Wi-Fi driver
Devices using RTL8723BS Wi-Fi chipsets (common in low-cost tablets, embedded systems, and single-board computers)

Discovery Timeline

2026-07-25 - CVE-2026-64444 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64444

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the OnAssocRsp() function of the rtl8723bs staging driver. Wi-Fi association response frames contain a sequence of Information Elements, each formatted as a Type-Length-Value structure with a one-byte element ID, a one-byte length field, and a variable-length data payload. The driver iterates through these IEs using an index i and advances by pIE->length + 2 per iteration.

The loop only validates i < pkt_len before dereferencing pIE. This check is insufficient in two ways. First, if the previous iteration lands the element ID byte at pkt_len - 1, reading pIE->length from pframe[pkt_len] accesses memory one byte past the allocated receive buffer. Second, even when the two-byte IE header sits within bounds, the declared pIE->length value can extend the IE data window beyond pkt_len, causing handler functions to consume adjacent memory as if it were valid IE payload.

Root Cause

The root cause is missing bounds validation on both the IE header read and the declared IE length before those values are used to compute the next parser offset. The upstream fix introduces two guards at the top of the loop body: one that breaks the loop when fewer than sizeof(*pIE) bytes remain in the frame, and one that breaks when the IE's declared data length would extend past pkt_len.

Attack Vector

Exploitation requires the attacker to operate within Wi-Fi radio range of the victim, matching the adjacent-network attack vector. A hostile access point sends a specially crafted 802.11 association response frame whose final IE truncates the length byte or declares a length larger than the remaining frame. When a vulnerable client running the rtl8723bs driver attempts to associate, the parser reads beyond the receive buffer and either leaks kernel slab contents to downstream logic or crashes the kernel, depending on adjacent memory layout.

No authentication is required and no user interaction beyond initiating or accepting Wi-Fi association is needed. Verified proof-of-concept code is not publicly available at the time of publication.

Detection Methods for CVE-2026-64444

Indicators of Compromise

Kernel oops or panic messages referencing OnAssocRsp, rtw_check_bcn_info, or rtl8723bs in dmesg or journalctl -k output
KASAN slab-out-of-bounds reports naming the rtl8723bs driver during Wi-Fi association attempts
Unexpected Wi-Fi disconnections or driver resets when associating with unfamiliar SSIDs

Detection Strategies

Enable KASAN on test kernels to catch the out-of-bounds read at runtime with precise call stacks
Monitor kernel log streams for rtl8723bs module warnings tied to association responses from previously unseen BSSIDs
Correlate wireless client crash events with nearby rogue AP telemetry from wireless intrusion detection systems

Monitoring Recommendations

Forward kernel logs from Linux endpoints using the rtl8723bs driver to a centralized log platform for anomaly detection
Alert on repeated association failures or driver resets across fleets of embedded devices with Realtek RTL8723BS chipsets
Track kernel package versions across managed Linux systems to confirm patched builds are deployed

How to Mitigate CVE-2026-64444

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix commits referenced in the kernel.org stable tree
Restrict affected devices from associating with untrusted Wi-Fi networks until patched
Where feasible, disable the rtl8723bs module on systems that do not require Realtek RTL8723BS Wi-Fi connectivity

Patch Information

The fix is distributed across multiple stable-tree commits, including 0406d746574e, 04f612dc0342, 0970dd47726a, 1a52a0547149, 7e7741c8315e, 889ca6000ac7, and f9654207e922. The patches add two guards at the top of the IE parsing loop: one that breaks if fewer than sizeof(*pIE) bytes remain, and one that breaks if the declared IE data extends past pkt_len. See the kernel.org stable commit references for the authoritative patch content.

Workarounds

Blacklist the rtl8723bs kernel module via /etc/modprobe.d/ on systems that do not require this Wi-Fi hardware
Use a wired network or an alternative USB Wi-Fi adapter with a different driver on affected devices
Configure client devices to connect only to known, trusted SSIDs with strong network authentication

bash

# Configuration example: blacklist the vulnerable driver until patched
echo "blacklist rtl8723bs" | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo rmmod rtl8723bs 2>/dev/null || true
sudo update-initramfs -u