Junglewise Threat Intelligence

CVE-2026-64536: Linux Kernel rtl8723bs out-of-bounds read in is_ap_in_tkip

CVE-2026-64536 · Severity: info · Published 2026-07-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security vulnerability was identified in the Linux kernel's Realtek RTL8723BS Wi-Fi driver. This driver is responsible for managing wireless network connections on devices using this specific hardware. An attacker within Wi-Fi range could potentially exploit this flaw to cause a system crash or read sensitive information from the system's memory by sending specially crafted network packets.

Technical details

An out-of-bounds (OOB) read vulnerability exists in the Linux kernel staging driver for Realtek RTL8723BS devices (drivers/staging/rtl8723bs/core/rtw_wlan_util.c). The function is_ap_in_tkip() iterates through Information Elements (IEs) in a buffer without verifying if the remaining buffer length is sufficient to hold the IE header or its declared payload. Specifically, it fails to check bounds before dereferencing pIE->element_id and pIE->length, and lacks minimum length checks for WLAN_EID_VENDOR_SPECIFIC (requires 16 bytes) and WLAN_EID_RSN (requires 12 bytes) before performing memory comparisons. This can be triggered by a malicious Access Point or an attacker spoofing one via adjacent network access. The issue has been resolved by adding explicit bounds checks for the IE header and payload lengths.

Affected products

  • Linux Linux Kernel 4.12 to 5.15.212, 6.1.100, 6.6.41, 6.9.10, 6.10.0

Timeline

  • 2026-05-22: disclosed: Initial patch submitted by Alexandru Hossu
  • 2026-07-18: patched: Patch committed to stable kernel trees
  • 2026-07-27: advisory: CVE published in NVD dataset

References

Related threats