Look up another CVE · open CVE-2026-64536 in the interactive tracker
CVE-2026-64536
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
Published 2026-07-27 (3 months ago) by the Linux kernel CNA. Subsystem drivers/staging. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64536 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.96-1 | Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE->element_id and pIE->length are read without checking that i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the buffer causes an OOB read. - For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12, which requires pIE->length >= 16. For WLAN_EID_RSN it compares pIE->data + 8, requiring pIE->length >= 12. Neither requirement is checked. Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE->length minimum, matching the pattern established in update_beacon_info().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/staging/rtl8723bs/core/rtw_wlan_util.c
- What this is
- STAGING SUBSYSTEMMAINTAINERS section matched on drivers/staging/ · linux-staging@lists.linux.dev · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-07-27 (3 months ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.25%, higher than 15.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/staging
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.12 | 5.15.212 | ea3809f7e20b |
| 4.12 | 6.1.178 | d2055332297e |
| 4.12 | 6.6.145 | 6f26cc55affd |
| 4.12 | 6.12.96 | 204b22c8df11 |
| 4.12 | 6.18.39 | a6105ea8ca6e |
| 4.12 | 7.1.4 | 4380b3860d88 |
| 4.12 | 7.2 | 3bf39f711ff2 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- A nearby malicious WiFi access point can supply crafted beacon or probe-response IEs that reach the vulnerable association path over the air.
- AC:LAttack complexity, low
- The attacker directly controls the malformed IE lengths and contents, and exploitation requires neither a race nor conditions outside the attacker's control.
- PR:NPrivileges required, none
- The vulnerable code executes before WPA credentials are verified; transmitting management frames as a malicious or spoofed AP requires no privileges on the target.
- UI:NUser interaction, none
- An attacker impersonating a configured AP can trigger the path during automatic connection or reconnection without contemporaneous user action.
- S:UScope, unchanged
- The vulnerable driver and affected kernel resources belong to the same host security authority, with no demonstrated VM, sandbox, or IOMMU boundary crossing.
- C:HConfidentiality impact, high
- The unchecked IE-header and fixed-offset comparisons read beyond attacker-declared buffer boundaries into adjacent kernel memory; under the required conservative OOB-read rule, confidentiality impact is high.
- I:NIntegrity impact, none
- The flaw performs reads and comparisons only, with no memory write or demonstrated data-modification primitive.
- A:HAvailability impact, high
- Malformed IEs can cause kernel out-of-bounds accesses during association and potentially fault or oops the kernel; a nearby attacker can repeat the exchange.