CVE-2026-64445: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64445 Overview

CVE-2026-64445 is a high-severity vulnerability in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in the OnAuth() function, which handles shared-key authentication frames. Two distinct bugs exist in the same code path: an integer underflow leading to an out-of-bounds (OOB) read in rtw_wep_decrypt(), and a fixed-size memcmp() that ignores the parsed Challenge Text information element (IE) length. An attacker within radio range of a vulnerable device can send crafted 802.11 authentication frames to trigger the flaw. The vulnerability affects Linux systems that load the rtl8723bs driver, which is common on low-cost single-board computers and embedded devices using Realtek RTL8723BS Wi-Fi chipsets.

Critical Impact
An adjacent-network attacker can trigger out-of-bounds kernel memory reads, potentially causing kernel information disclosure, denial of service, or memory corruption during 802.11 shared-key authentication processing.

Affected Products

Linux kernel drivers/staging/rtl8723bs Wi-Fi driver (pre-patch)
Linux distributions shipping the staging rtl8723bs driver on affected kernel versions
Embedded and single-board devices using Realtek RTL8723BS Wi-Fi hardware

Discovery Timeline

2026-07-25 - CVE-2026-64445 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64445

Vulnerability Analysis

The OnAuth() function in the rtl8723bs driver processes incoming IEEE 802.11 authentication frames. When the frame's Privacy bit is set, the driver invokes rtw_wep_decrypt() on the frame body without first validating that the frame is large enough to contain a valid Wired Equivalent Privacy (WEP) Initialization Vector (IV) and Integrity Check Value (ICV).

Inside rtw_wep_decrypt(), the driver computes payload length as length = len - WLAN_HDR_A3_LEN - iv_len and later passes length - 4 to crc32_le(). If the incoming frame length is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), the subtraction underflows. Because the result is implicitly cast to size_t, crc32_le() interprets the negative value as a very large unsigned length and reads far past the end of the frame buffer.

The second bug occurs when processing a seq=3 shared-key authentication response. The driver calls rtw_get_ie() to locate the Challenge Text IE and stores its parsed length in ie_len. The subsequent memcmp() then always compares 128 bytes regardless of the actual value in ie_len, creating another OOB read when an attacker sends a shorter Challenge Text IE.

Root Cause

The root cause is missing input validation on attacker-controlled 802.11 frame lengths [Integer Underflow, Out-of-Bounds Read]. The driver trusts the on-air frame length and the parsed IE length fields without enforcing minimum-size or exact-size checks before performing arithmetic and memory comparisons. IEEE 802.11 mandates a Challenge Text of exactly 128 bytes, but the driver never enforced this constraint prior to the fix.

Attack Vector

Exploitation requires adjacent-network access, meaning the attacker must be within Wi-Fi radio range of the target device. No authentication or user interaction is needed. The attacker transmits a malformed 802.11 authentication frame with either an undersized body carrying the Privacy bit set, or a seq=3 response containing a Challenge Text IE whose length field is smaller than 128 bytes. The vulnerable driver then performs the underflowed length calculation or the fixed-size memcmp(), reading kernel memory beyond the frame buffer.

No verified public exploit code is available. Technical details of the fix are documented in the upstream kernel commits, including commit 1f6c9d25 and commit 3e44a766.

Detection Methods for CVE-2026-64445

Indicators of Compromise

Kernel oops, KASAN, or slab-out-of-bounds reports referencing rtw_wep_decrypt, crc32_le, or OnAuth in the rtl8723bs module
Unexpected Wi-Fi disconnections or interface resets on devices using the rtl8723bs driver
Unusual bursts of malformed 802.11 authentication frames observed in wireless monitoring captures

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test builds to catch the out-of-bounds read during fuzzing or exposure to crafted frames
Monitor dmesg and /var/log/kern.log for stack traces originating in drivers/staging/rtl8723bs and correlate with Wi-Fi authentication events
Inventory endpoints and IoT devices for the presence of the rtl8723bs kernel module using lsmod | grep rtl8723bs

Monitoring Recommendations

Forward kernel logs from Linux endpoints and embedded devices to a centralized logging or SIEM platform for correlation of driver crashes
Deploy wireless intrusion detection sensors in high-value physical areas to identify anomalous 802.11 authentication frame patterns
Track kernel version and staging driver inventory across the fleet to prioritize patch deployment on affected hosts

How to Mitigate CVE-2026-64445

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE and rebuild or update to a stable kernel release that includes the fixes
Where patching is not immediately possible, unload the rtl8723bs module and blacklist it if the affected hardware is not required
Restrict physical proximity and radio exposure of vulnerable devices in high-risk environments until patches are deployed

Patch Information

The vulnerability is fixed by upstream Linux kernel commits that add a minimum length check before accessing the WEP IV and calling rtw_wep_decrypt(), and that reject Challenge Text IEs whose length differs from 128 bytes. The relevant fixes are available in the kernel stable tree, including commit 64ec4192, commit 665e1ecb, commit 87cccc2a, commit a1fc19d6, commit c9000c93, and commit d90b9f39. Consult your Linux distribution advisory for backported package updates.

Workarounds

Disable the rtl8723bs driver at boot by adding blacklist rtl8723bs to /etc/modprobe.d/ on systems that do not require the affected Wi-Fi chipset
Prefer wired networking or replace RTL8723BS-based adapters with a supported alternative on high-risk endpoints
Disable WEP and shared-key authentication on any managed access points; note this reduces exposure via legitimate infrastructure but does not stop a rogue attacker frame

bash

# Configuration example: blacklist the vulnerable driver until patched
echo 'blacklist rtl8723bs' | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo rmmod rtl8723bs 2>/dev/null || true
sudo update-initramfs -u