CVE-2026-64443 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions.
Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past len.
Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within the Linux kernel's staging driver for rtl8723bs wireless network adapters and represents a critical out-of-bounds read condition that could enable arbitrary code execution or system compromise. The flaw manifests in the update_beacon_info() function which processes beacon frames received from access points, specifically during the parsing of information elements within these frames. The vulnerability stems from inadequate bounds checking during the iteration through information element structures, creating a scenario where an attacker-controlled malicious access point can craft specially formatted beacon frames that trigger memory access violations.
The technical implementation of this vulnerability occurs due to improper validation of information element boundaries within the beacon frame parsing loop. The code advances the iteration pointer by (pIE->length + 2) bytes on each iteration without first verifying that sufficient data remains in the buffer for both the header and the declared data portion. When an attacker sends a beacon frame where the final information element's element_id byte is positioned at exactly len-1, the loop attempts to read pIE->length from memory that lies beyond the allocated receive buffer boundaries. This specific scenario creates a direct out-of-bounds memory access pattern that violates fundamental security principles of memory safety and buffer management.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions to potentially enable remote code execution within the kernel context. Attackers can leverage this flaw by positioning a malicious access point within range of vulnerable devices, causing the wireless driver to process malformed beacon frames that trigger the out-of-bounds read condition. The vulnerability is particularly concerning because it operates at the kernel level where successful exploitation could result in complete system compromise, privilege escalation, and persistent backdoor access. The issue demonstrates poor adherence to secure coding practices as outlined in the CERT Secure Coding Standards and CWE-129, which specifically addresses improper bounds checking in input validation.
The mitigation strategy involves implementing comprehensive bounds checking at the beginning of each iteration cycle to prevent both header and data portion access violations. The fix introduces two critical guard conditions that break the parsing loop when fewer than sizeof(pIE) bytes remain for header reading or when the declared element length would extend beyond the buffer boundaries. Additionally, the code modification replaces the traditional increment mechanism with a more consistent approach using sizeof(pIE) + pIE->length, ensuring that all calculations align with the newly implemented safety checks. This remediation directly addresses the ATT&CK technique T1068 by preventing privilege escalation through kernel-level memory corruption and aligns with defensive programming principles from the OWASP Secure Coding Practices.
The vulnerability classification places this issue within CWE-129 (Improper Validation of Array Index) and CWE-787 (Out-of-bounds Write), representing a classic buffer overrun scenario that can be exploited for privilege escalation. The rtl8723bs driver's implementation failure demonstrates the critical importance of input validation in kernel space components where malicious inputs can lead to complete system compromise. This vulnerability exemplifies why network drivers require extensive security testing and why proper bounds checking mechanisms are essential in wireless protocol implementations. The fix ensures that all information element processing adheres to strict buffer boundary constraints, preventing attackers from exploiting malformed beacon frames to execute arbitrary code within the kernel space.
Security researchers have identified this issue as particularly dangerous due to its potential for remote exploitation through wireless networks where malicious access points can be easily deployed. The vulnerability affects all Linux systems running with the rtl8723bs driver and requires immediate patching to prevent exploitation. Organizations should prioritize updating their kernel versions to include the patched driver implementation, while network administrators should monitor for suspicious wireless activity that might indicate exploitation attempts. The fix demonstrates proper defensive programming practices and serves as a model for secure handling of user-controllable data in kernel modules, emphasizing the need for rigorous input validation even in specialized hardware drivers.