CVE-2026-64440 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB write in HT_caps_handler()
HT_caps_handler() iterates pIE->length bytes and writes into HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct
HT_caps_element). Because pIE->length is a raw u8 from an over-the-air 802.11 AssocResponse frame and is never validated, a malicious AP can set it up to 255, causing up to 229 bytes of out-of-bounds writes into adjacent fields of struct mlme_ext_info.
Truncate the iteration count to the size of HT_caps.u.HT_cap using umin() so that data from a longer-than-expected IE is silently ignored rather than written out of bounds, preserving interoperability with APs that pad the element. An early return on oversized IEs was considered but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1 assignment that precedes the loop, silently disabling HT mode for APs that append extra bytes to the HT Capabilities IE.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability resides in the Linux kernel's staging driver for rtl8723bs wireless network adapters where a buffer overflow condition occurs during handling of 802.11 association responses. The flaw manifests in the HT_caps_handler() function which processes the HT Capabilities information element from wireless access points. The function iterates through a byte count specified by pIE->length field that originates from an unvalidated 802.11_ASSOCRESP frame received over-the-air, creating a direct pathway for malicious exploitation.
The technical implementation involves a fixed 26-byte array HT_caps.u.HT_cap[] within the struct HT_caps_element structure that serves as the destination for data writes during the iteration process. However, since pIE->length is a raw unsigned 8-bit value extracted directly from wireless frames without validation, an attacker-controlled access point can set this length parameter to extreme values up to 255 bytes. This manipulation results in up to 229 bytes of out-of-bounds memory writes into adjacent fields of the struct mlme_ext_info structure, effectively corrupting kernel memory and potentially enabling arbitrary code execution or system instability.
This vulnerability directly maps to CWE-121 Stack-based Buffer Overflow and CWE-787 Out-of-bounds Write according to the Common Weakness Enumeration catalog, representing a classic buffer overflow scenario where input validation fails to constrain data access. The ATT&CK framework categorizes this under T1059 Command and Scripting Interpreter and potentially T1499 Endpoint Denial of Service as it can lead to system crashes or unauthorized privilege escalation through memory corruption.
The operational impact extends beyond simple denial of service since the corrupted memory structures can affect kernel stability, wireless connectivity management, and potentially provide attackers with footholds for more sophisticated attacks. The vulnerability affects devices running Linux kernels with the rtl8723bs driver when connecting to malicious wireless networks, making it particularly concerning for mobile devices and embedded systems that rely on this specific wireless chipset.
The fix implements a defensive programming approach using umin() function to truncate the iteration count to the actual array size of HT_caps.u.HT_cap[], ensuring that any oversized information elements are silently ignored rather than causing memory corruption. This solution maintains backward compatibility with legitimate access points that may pad their information elements while preventing malicious exploitation. The approach avoids early return mechanisms that would disable HT mode functionality for compliant APs, preserving network interoperability and wireless performance features.
The mitigation strategy focuses on kernel-level patching where the fix ensures proper bounds checking before memory operations, demonstrating how input validation should always precede buffer operations in kernel space code. This represents a fundamental security principle in systems programming where untrusted inputs from network protocols must be rigorously validated before processing to prevent exploitation of memory corruption vulnerabilities that could compromise entire system integrity.