CVE-2026-64536: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64536 Overview

CVE-2026-64536 is an out-of-bounds read vulnerability in the Linux kernel staging/rtl8723bs wireless driver. The flaw resides in the is_ap_in_tkip() function, which iterates over Information Elements (IEs) from wireless beacon or probe response frames without validating that enough bytes remain in the buffer. A truncated IE at the end of the buffer causes the kernel to dereference memory beyond the intended bounds. An attacker within wireless range can trigger the condition by transmitting crafted 802.11 management frames.

Critical Impact
Adjacent-network attackers can cause kernel memory disclosure or system crashes on hosts using the rtl8723bs Wi-Fi driver, resulting in loss of confidentiality and availability.

Affected Products

Linux kernel staging/rtl8723bs wireless driver (Realtek RTL8723BS SDIO Wi-Fi)
Multiple stable kernel branches referenced by upstream fix commits
Distributions shipping the rtl8723bs staging driver on affected kernels

Discovery Timeline

2026-07-27 - CVE-2026-64536 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64536

Vulnerability Analysis

The is_ap_in_tkip() function walks a buffer of 802.11 Information Elements to determine whether an access point advertises Temporal Key Integrity Protocol (TKIP). Each IE begins with a two-byte header containing element_id and length, followed by a variable-length payload. The loop reads pIE->element_id and pIE->length without first confirming that i + sizeof(*pIE) <= ie_length. A truncated IE at the tail of the buffer therefore causes the parser to dereference bytes past the end of the allocation.

The payload checks compound the issue. For WLAN_EID_VENDOR_SPECIFIC, the code compares pIE->data + 12, which requires pIE->length >= 16. For WLAN_EID_RSN, it compares pIE->data + 8, requiring pIE->length >= 12. Neither minimum is validated, so a short IE causes reads beyond the declared payload. The fix adds explicit IE header and payload bounds checks and guards each data access with a pIE->length minimum, matching the pattern used in update_beacon_info().

Root Cause

The root cause is missing input validation [Out-of-Bounds Read] in a driver that trusts attacker-controllable 802.11 frame contents. The IE parser assumes well-formed frames and lacks defensive length checks against both the containing buffer and the IE-specific payload requirements.

Attack Vector

An attacker within wireless range of a host running the rtl8723bs driver can broadcast a beacon, probe response, or association frame containing a malformed IE. When the driver evaluates the frame during scan or association processing, the parser reads past the buffer, potentially leaking adjacent kernel memory or triggering a fault that halts the affected subsystem. No authentication or user interaction is required.

The vulnerability is described in prose because no verified exploit code is publicly available. Refer to the upstream fix commits linked below for the exact code differences.

Detection Methods for CVE-2026-64536

Indicators of Compromise

Kernel oops or KASAN reports naming is_ap_in_tkip or r8723bs in the stack trace
Unexpected reboots or Wi-Fi subsystem hangs on devices using the rtl8723bs SDIO chipset during scanning near untrusted networks
dmesg warnings referencing invalid IE lengths in the staging rtl8723bs driver

Detection Strategies

Deploy kernels compiled with KASAN in test fleets to surface out-of-bounds reads originating from IE parsing
Inventory hosts loading the r8723bs module using package and module telemetry, then cross-reference with running kernel versions against the patched commits
Monitor wireless intrusion detection sensors for malformed beacon or probe response frames with truncated IEs near sensitive endpoints

Monitoring Recommendations

Collect kernel logs centrally and alert on driver-originated oops, WARN, or KASAN entries referencing rtl8723bs
Track loaded kernel modules and running kernel versions across Linux endpoints to identify unpatched systems
Correlate wireless environment anomalies with endpoint crash telemetry to identify targeted exploitation attempts

How to Mitigate CVE-2026-64536

Immediate Actions Required

Update to a Linux kernel that includes the upstream fixes referenced by commits 204b22c, 3bf39f7, 4380b38, 6f26cc5, a6105ea, d205533, and ea3809f7
Where patching is delayed, unload the driver with modprobe -r r8723bs and blacklist the module on hosts that do not require this chipset
Restrict use of affected devices to trusted wireless environments until the patched kernel is deployed

Patch Information

Fixes have been merged into stable branches of the Linux kernel. Review the upstream commits: Kernel Commit 204b22c, Kernel Commit 3bf39f7, Kernel Commit 4380b38, Kernel Commit 6f26cc5, Kernel Commit a6105ea, Kernel Commit d205533, and Kernel Commit ea3809f7. Apply the distribution kernel update that references these commits.

Workarounds

Blacklist the r8723bs module on systems that do not depend on the Realtek RTL8723BS SDIO adapter
Disable the wireless interface when not required, or replace the RTL8723BS adapter with a supported chipset that uses a mainline driver
Keep affected devices out of range of untrusted 802.11 broadcasters until the kernel is patched

bash

# Blacklist the vulnerable staging driver until the kernel is patched
echo 'blacklist r8723bs' | sudo tee /etc/modprobe.d/blacklist-r8723bs.conf
sudo modprobe -r r8723bs
sudo update-initramfs -u