Skip to main content

Linux Kernel CVE-2026-64442

| EUVDEUVD-2026-48786 HIGH
Out-of-bounds Read (CWE-125)
2026-07-25 Linux GHSA-9c3c-vw6j-5852
Information Disclosure Linux
8.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
8.1 HIGH

Adjacent vector (WiFi beacon), no auth needed, confidentiality high for kernel OOB read, integrity unaffected, availability high for potential panic.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 16, 2026 - 09:40 vuln.today
tag: Buffer Overflow removed
Analysis Generated
Jul 27, 2026 - 05:55 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
8.1 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:51 cve.org
HIGH 8.1
CVE Published
Jul 25, 2026 - 08:51 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Two IE parsing loops are missing the header bounds checks before they dereference pIE->length:

  • issue_assocreq() walks pmlmeinfo->network.ies to build the

association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer.

  • join_cmd_hdl() walks pnetwork->ies during station join and has

the same problem under the same conditions.

Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue.

Apply the two-guard pattern established in update_beacon_info():

  1. Break if fewer than sizeof(*pIE) bytes remain.
  2. Break if the IE's declared data extends past the buffer end.

AnalysisAI

Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an attacker-controlled access point to leak kernel memory or crash affected systems by sending beacon or probe-response frames with a truncated final information element. Two IE-parsing loops in issue_assocreq() and join_cmd_hdl() dereference pIE->length without first verifying that at least sizeof(*pIE) bytes remain in the buffer, so a one-byte stub IE at the end of AP-supplied data reads one byte past the buffer end. No public exploit has been identified at time of analysis, and EPSS sits at 0.22%, consistent with the adjacent-network attack vector and niche driver footprint.

Technical ContextAI

The rtl8723bs is a Linux staging driver (drivers/staging/rtl8723bs) for Realtek RTL8723BS 802.11n WiFi SoC chips, commonly embedded in budget single-board computers, tablets, and mini-PCs running Linux. The vulnerability is in Information Element (IE) parsing: 802.11 management frames (beacons, probe responses) carry a sequence of TLV-structured IEs, each beginning with a one-byte element_id and a one-byte length. Two functions - issue_assocreq() and join_cmd_hdl() - iterate over AP-supplied IE buffers stored in pmlmeinfo->network.ies and pnetwork->ies respectively, casting each position to a struct pIE pointer and reading pIE->length before confirming that at least two bytes (sizeof(*pIE)) remain. CWE-125 (Out-of-bounds Read) applies: a malicious AP can craft a frame whose final IE contains only the element_id byte, causing the length field read to fall one byte past the allocated buffer. Affected CPEs span cpe:2.3:a:linux:linux across multiple stable branches from kernel 4.12 (introduction of the vulnerable code via commit 554c0a3abf21) through all unfixed releases.

RemediationAI

Upgrade to a patched kernel version: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc3 or later. Upstream fix commits are available at git.kernel.org (bc881c99, 605ebd94, a830bdc8, 4c21eec8, ad2637c4, c38d16b1, 402f13ec, ef61d628). Ubuntu users should apply the kernels referenced in USN-8726-1 and USN-8727-1. If immediate patching is not possible, unloading the rtl8723bs kernel module (rmmod r8723bs) eliminates the attack surface entirely, at the cost of losing WiFi connectivity on devices using that chip. Alternatively, restricting WiFi association to trusted networks via allowlisting BSSIDs in NetworkManager or wpa_supplicant prevents exposure to malicious APs, but does not protect against rogue APs spoofing trusted SSIDs. The module-unload approach has no side effects beyond loss of WiFi on the specific chipset.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64442 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy