CVE-2026-64446 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel's rtl8723bs staging driver represents a critical heap buffer overflow condition that could potentially enable privilege escalation or system instability. This issue resides within the wireless networking subsystem where the driver processes WPA and WPA2 information elements during network connection establishment. The flaw manifests when a local user crafts a malicious nl80211 connect request containing a specially formatted WPA IE with a length of 255 bytes, exploiting an inadequate bounds checking mechanism that fails to account for the additional two bytes required for the IE header.
The technical implementation of this vulnerability stems from improper buffer management within the security_priv structure where supplicant_ie is allocated as a fixed 256-byte array. The problematic code path executes memcpy operations without sufficient validation, allowing a crafted WPA IE of maximum length to overflow into adjacent memory regions. Specifically, when wpa_ielen equals 255, the calculation wpa_ielen + 2 produces 257, exceeding the available 256-byte buffer capacity by exactly one byte. This overflow directly impacts the last_mic_err_time field that immediately follows the supplicant_ie array in memory, potentially corrupting critical timing data used for security validation.
The root cause lies in the rtw_parse_wpa_ie() function's inadequate length consistency check which performs a comparison using unsigned 8-bit values that silently accept invalid lengths. The check *(wpa_ie+1) against (u8)(wpa_ie_len-2) becomes problematic when wpa_ie_len equals 257, as the cast to u8 preserves the value 255 while the comparison passes despite the actual overflow condition. This design flaw allows malformed input to bypass validation entirely and triggers the buffer overflow during memory copy operations.
This vulnerability aligns with CWE-121 Stack-based Buffer Overflow and CWE-787 Out-of-bounds Write, representing a classic case of insufficient bounds checking in kernel-space network processing code. From an operational security perspective, this flaw creates potential attack vectors for local privilege escalation since the buffer overflow could be exploited to modify adjacent memory regions including critical timing fields used for cryptographic security validation. The impact extends beyond simple memory corruption as it affects the integrity of wireless security mechanisms that rely on proper MIC error tracking.
Mitigation strategies should implement explicit bounds checking before any memcpy operations, ensuring that the total IE size including headers does not exceed the available buffer capacity. The solution requires adding validation logic to reject WPA IEs where wpa_ielen + 2 exceeds the 256-byte supplicant_ie buffer limit. This approach directly addresses the ATT&CK technique T1068 Exploitation for Privilege Escalation by preventing malicious input from corrupting kernel memory structures. Additionally, implementing comprehensive input validation and bounds checking throughout the wireless driver codebase would prevent similar issues in related functions that process similar network information elements.
The fix demonstrates proper defensive programming principles where all external inputs are validated before processing, particularly critical in kernel-space drivers handling network protocols. This vulnerability highlights the importance of memory safety practices in embedded wireless subsystems and emphasizes the need for rigorous bounds checking in security-sensitive code paths. The solution maintains backward compatibility while strengthening the driver's resilience against malformed network configuration data that could otherwise compromise system stability and security integrity through memory corruption attacks.