CVE-2026-64444 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_len. When a malicious AP sends an AssocResponse whose last IE has only one byte remaining in the frame (the element_id byte lands at pkt_len-1), the loop reads pIE->length from pframe[pkt_len], which is one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond pkt_len, silently passing a truncated IE to the handler functions.
Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past pkt_len.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within the rtl8723bs staging driver in the Linux kernel, specifically in the OnAssocRsp() function responsible for processing association response frames from wireless access points. The issue represents a classic out-of-bounds read condition that occurs during information element parsing, where the driver fails to properly validate buffer boundaries before accessing structured data within received network frames.
The technical flaw stems from an insufficient validation mechanism in the IE (information element) parsing loop that processes wireless frame elements. The loop advances by (pIE->length + 2) bytes on each iteration but only checks if the current position i remains less than the packet length pkt_len. This approach creates a critical gap where malicious actors can exploit the buffer boundary condition, particularly when an association response contains an information element whose element_id byte lands exactly at pkt_len-1 position. In such cases, the loop attempts to read pIE->length from memory location pframe[pkt_len], which extends one byte beyond the allocated receive buffer, resulting in undefined behavior and potential memory corruption.
The vulnerability manifests through multiple attack vectors that exploit the inherent race condition between header validation and data access. Even when header bytes remain within bounds, the pIE->length field itself can contain values that extend the effective data window beyond pkt_len boundaries, causing the driver to silently process truncated information elements without proper error handling or boundary checking. This silent failure mode allows attackers to craft malicious association responses that can trigger memory corruption and potentially enable privilege escalation attacks.
From a cybersecurity perspective, this vulnerability aligns with CWE-129 Input Validation and Output Validation issues, specifically addressing improper bounds checking in buffer operations. The flaw demonstrates characteristics consistent with ATT&CK technique T1059 Command and Scripting Interpreter where an attacker could exploit the kernel memory corruption to execute arbitrary code, though the direct execution path requires additional attack vectors such as a successful privilege escalation or use-after-free conditions that may be chained with this vulnerability.
The impact of this vulnerability extends beyond simple memory corruption to potentially enable more sophisticated attacks including kernel exploitation and system compromise. When combined with other kernel vulnerabilities or when exploited in conjunction with privilege escalation opportunities, the out-of-bounds read can result in complete system compromise. The fix addresses these concerns by implementing two critical defensive checks within the loop body that prevent both header and data boundary violations.
The mitigation strategy requires careful implementation of bounds checking before any structured data access occurs in network frame parsing routines. The proposed solution adds validation at the beginning of each loop iteration to ensure sufficient bytes remain for reading the complete IE header structure and to verify that the declared element length does not exceed available buffer space. This approach follows established security principles for buffer overflow prevention and aligns with industry best practices for kernel security hardening.
This vulnerability represents a critical risk in wireless networking drivers where network input validation is paramount due to the untrusted nature of wireless frame data. The fix demonstrates the importance of defensive programming techniques in kernel space where memory safety violations can lead to complete system compromise, emphasizing the need for comprehensive bounds checking in all network protocol parsing code and reinforcing the principle that all external input must be validated before processing regardless of trust level or expected source reliability.