CVE-2026-64446: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64446 Overview

CVE-2026-64446 is a heap buffer overflow in the Linux kernel's rtl8723bs staging Wi-Fi driver. The flaw resides in rtw_cfg80211_set_wpa_ie(), which copies a user-supplied WPA or WPA2 Information Element (IE) into the fixed 256-byte supplicant_ie field inside struct security_priv. A local user can submit a connect request through nl80211 with a crafted IE length of 255. The resulting memcpy of wpa_ielen + 2 bytes writes 257 bytes and overflows the buffer by one byte into the adjacent last_mic_err_time field.

Critical Impact
A local user with permission to trigger nl80211 connect requests can corrupt adjacent kernel heap data on systems using the rtl8723bs driver, enabling denial of service or potential privilege escalation.

Affected Products

Linux kernel staging subsystem — rtl8723bs driver
Kernel builds that enable CONFIG_RTL8723BS
Distributions shipping the vulnerable staging driver prior to the fix commits referenced in stable trees

Discovery Timeline

2026-07-25 - CVE-2026-64446 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64446

Vulnerability Analysis

The rtl8723bs staging driver stores parsed supplicant IEs in padapter->securitypriv.supplicant_ie, a fixed 256-byte array. During processing of a WPA or WPA2 connect request, the driver executes:

memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);

Here wpa_ielen is the raw length field taken from the IE header. Because that field is a u8, its maximum value is 255. Copying wpa_ielen + 2 bytes therefore writes up to 257 bytes into a 256-byte destination, corrupting the adjacent last_mic_err_time member of struct security_priv [CWE-122]. The single-byte overflow is deterministic and controllable by the caller.

Root Cause

The consistency check in rtw_parse_wpa_ie() compares *(wpa_ie+1) against (u8)(wpa_ie_len-2). When wpa_ie_len equals 257, the cast to u8 truncates the value to 255, matching the IE length byte. The check passes silently and the oversized IE reaches memcpy without any bound test against the destination buffer size.

Attack Vector

A local user issues a connect request via the nl80211 netlink interface, attaching a WPA or WPA2 IE with the length field set to 255. The kernel path handling the request invokes rtw_cfg80211_set_wpa_ie(), which copies the crafted IE into supplicant_ie and overwrites one byte of the adjacent field. Repeated invocations enable an attacker to shape heap state around the target structure. The vulnerability requires the target host to have the rtl8723bs driver loaded and a local account able to interact with nl80211.

No verified public exploit code is available. The upstream fix adds explicit bounds checks on both the WPA and WPA2 paths, rejecting any IE where wpa_ielen + 2 exceeds the size of supplicant_ie before the memcpy executes.

Detection Methods for CVE-2026-64446

Indicators of Compromise

Kernel log entries referencing rtw_cfg80211_set_wpa_ie or rtw_parse_wpa_ie alongside memory corruption warnings from KASAN, slab redzone checks, or BUG: KASAN: slab-out-of-bounds.
Unexpected process crashes, panics, or oops messages on hosts running the rtl8723bs driver following nl80211 connect activity.
Anomalous wpa_supplicant or NetworkManager behavior triggered by non-standard local processes issuing connect requests.

Detection Strategies

Enable KASAN on test kernels to catch the one-byte overflow at the moment of the vulnerable memcpy.
Audit loaded kernel modules across the fleet and flag any host with rtl8723bs present that has not been updated.
Monitor nl80211 and CFG80211 activity for connect requests carrying IEs at the maximum permitted length.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central store and alert on KASAN, slab-out-of-bounds, and general protection fault entries referencing the driver.
Track local privilege escalation and unexpected root-owned processes on hosts with the vulnerable driver loaded.
Baseline the set of accounts and services permitted to trigger nl80211 operations and alert on deviations.

How to Mitigate CVE-2026-64446

Immediate Actions Required

Update to a Linux kernel that includes the referenced stable fixes for rtw_cfg80211_set_wpa_ie().
If patching is not immediately possible, unload the rtl8723bs module on systems where it is not required with modprobe -r rtl8723bs.
Restrict local access to hosts using the vulnerable driver and limit which accounts can invoke nl80211 operations.

Patch Information

The fix adds explicit bounds checks before the memcpy calls in both the WPA and WPA2 code paths, rejecting any IE whose total size exceeds sizeof(supplicant_ie). The change has been applied across multiple stable branches. Reference commits: 138cd19, 21316219, 46f66c16, 5a752a61, 5d781236, 6f20d7b0, a94a643a, and b9c4bf13.

Workarounds

Blacklist the rtl8723bs module on systems that do not require the RTL8723BS Wi-Fi chipset.
Enforce least privilege on local accounts to prevent untrusted users from triggering nl80211 connect requests.
Rebuild kernels with hardening options such as KASAN in test environments and CONFIG_SLAB_FREELIST_HARDENED in production to raise the cost of heap corruption exploitation.

bash

# Blacklist the vulnerable driver until the kernel is patched
echo 'blacklist rtl8723bs' | sudo tee /etc/modprobe.d/blacklist-rtl8723bs.conf
sudo modprobe -r rtl8723bs
sudo update-initramfs -u