Look up another CVE · open CVE-2026-64442 in the interactive tracker
CVE-2026-64442
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64442 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.96-1 | Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer. - join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions. Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue. Apply the two-guard pattern established in update_beacon_info(): 1. Break if fewer than sizeof(*pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
- What this is
- STAGING SUBSYSTEMMAINTAINERS section matched on drivers/staging/ · linux-staging@lists.linux.dev · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-07-25 (3 months ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.29%, higher than 19.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.12 | 5.10.261 | bc881c9915c4 |
| 4.12 | 5.15.212 | 605ebd94d0f4 |
| 4.12 | 6.1.178 | a830bdc82461 |
| 4.12 | 6.6.145 | 4c21eec80cf5 |
| 4.12 | 6.12.96 | ad2637c46ef8 |
| 4.12 | 6.18.39 | c38d16b1ffac |
| 4.12 | 7.1.4 | 402f13ec9594 |
| 4.12 | 7.2 | ef61d628dfad |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- A malicious AP within WiFi radio range can supply crafted beacon or probe-response IEs that reach both vulnerable loops during connection.
- AC:LAttack complexity, low
- The attacker directly controls the IE layout and declared lengths, and triggering requires no race or condition outside attacker control.
- PR:NPrivileges required, none
- join_cmd_hdl() executes before authentication, while issue_assocreq() precedes WPA/802.1X credential verification; the rogue AP needs no valid credentials.
- UI:NUser interaction, none
- Devices can automatically reconnect to a rogue AP spoofing a saved SSID, so no contemporaneous victim action is required.
- S:UScope, unchanged
- The vulnerable parser and resulting impacts remain within the host kernel's existing security authority.
- C:HConfidentiality impact, high
- A malicious length can cause reads of up to 255 bytes beyond the logical IE boundary, including kernel pointers or state, and issue_assocreq() can transmit those bytes to the attacking AP.
- I:NIntegrity impact, none
- The defect performs out-of-bounds reads and copies into legitimate destinations, without providing an out-of-bounds or arbitrary write primitive.
- A:HAvailability impact, high
- The malformed lengths drive unchecked kernel-context reads through multiple handlers and can cause an oops or kernel fault; an adjacent attacker can repeat the trigger during connection attempts.