Executive brief
A security vulnerability has been identified in the Linux kernel's Realtek Wi-Fi driver (rtl8723bs). A local user could potentially crash the system or cause unpredictable behavior by sending a specially crafted Wi-Fi connection request. This issue affects devices using this specific wireless hardware and has been resolved in recent kernel updates.
Technical details
A heap buffer overflow exists in the staging rtl8723bs driver within the rtw_cfg80211_set_wpa_ie() function. The vulnerability is caused by insufficient bounds checking when copying WPA/WPA2 Information Elements (IE) into the 256-byte supplicant_ie array. Specifically, when a local user provides a crafted IE of length 255 via nl80211, the driver attempts to copy 257 bytes (length + 2), resulting in a one-byte overflow into adjacent memory (last_mic_err_time). The existing consistency check in rtw_parse_wpa_ie() failed to catch this due to a casting error. The fix introduces explicit bounds checks before the memcpy operation.
Affected products
- Linux Linux Kernel 554c0a3abf21 to a94a643a80a8, 2131621986c6, 6f20d7b0ee47, 5d7812360abf, 46f66c16a951, b9c4bf133c3c, 138cd190efd5, 5a752a616e75
Timeline
- 2026-05-22: disclosed: Initial patch submitted by Alexandru Hossu
- 2026-07-25: advisory: CVE-2026-64446 published in NVD
References
- https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b
- https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6
- https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c
- https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655
- https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28
- https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603
- https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5