Skip to main content

Linux Kernel CVE-2026-64446

| EUVDEUVD-2026-48790 HIGH
Out-of-bounds Write (CWE-787)
2026-07-25 Linux GHSA-49pq-8ggv-fqjq
Buffer Overflow Linux Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only attack via nl80211 (AV:L), low-privilege user account required (PR:L), no interaction needed; full kernel memory corruption potential justifies C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 03, 2026 - 15:57 vuln.today
CVSS changed
Sep 03, 2026 - 15:52 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:51 nvd
HIGH 7.8
CVE Published
Jul 25, 2026 - 08:51 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:

memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);

where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.

rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.

Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.

AnalysisAI

Heap buffer overflow in the Linux kernel's rtl8723bs staging WiFi driver (rtw_cfg80211_set_wpa_ie()) allows a local low-privileged user to corrupt kernel memory by one byte via a crafted nl80211 connect request, enabling potential privilege escalation to kernel context. The 256-byte supplicant_ie array in struct security_priv overflows when a WPA IE with length 255 is supplied, writing 257 bytes and clobbering the adjacent last_mic_err_time field; a flawed length check in rtw_parse_wpa_ie() using u8 narrowing silently permits the overflow. Patches are available across all active stable kernels; EPSS is 0.23% and no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

The vulnerability is in the staging/rtl8723bs driver, which supports the Realtek RTL8723BS 802.11n SDIO WiFi chipset found in embedded boards, tablets, and some single-board computers. The affected code path is rtw_cfg80211_set_wpa_ie(), called when a userspace WPA supplicant or nl80211 tool submits a connect request containing WPA or WPA2 IEs. The supplicant_ie field in struct security_priv is a fixed 256-byte stack-allocated array. The memcpy call copies wpa_ielen+2 bytes, where wpa_ielen is a raw u8 from the IE header; a value of 255 causes a 257-byte copy, a one-byte out-of-bounds write (CWE-787) past the buffer into the immediately following last_mic_err_time field. The guard in rtw_parse_wpa_ie() is broken because it compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), and (u8)(257-2) (u8)(255) 255 silently satisfies the equality. The CPE strings confirm this is the Linux kernel (cpe:2.3:a:linux:linux:*).

RemediationAI

The primary fix is upgrading to a patched stable kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc3 or later. The upstream commits are available at https://git.kernel.org/stable/c/ (see affected versions for commit hashes) and via https://nvd.nist.gov/vuln/detail/CVE-2026-64446. If an immediate kernel upgrade is not feasible, the compensating control is to blacklist the rtl8723bs module (echo 'blacklist rtl8723bs' >> /etc/modprobe.d/blacklist.conf && rmmod rtl8723bs if loaded), which disables all functionality of the RTL8723BS WiFi chipset but eliminates the attack surface entirely. Restricting unprivileged access to nl80211 via network namespace isolation or removing unprivileged user access to the affected system is a secondary mitigation but does not remove the vulnerability. Distributions shipping the rtl8723bs staging driver should apply vendor-supplied kernel updates through their standard package management channels.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-64446 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy