What is the CVSS score of CVE-2026-64536?

CVE-2026-64536 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64536?

The Realtek Wi-Fi driver present in Linux systems can be compromised remotely by attackers operating a malicious access point, potentially exposing kernel memory or crashing affected devices.. A patch is available.

How to fix or mitigate CVE-2026-64536?

Within 24 hours, identify all systems running the rtl8723bs driver (check with: lsmod | grep rtl8723bs) and document their network exposure, particularly mobile devices or servers in shared environments. Within 7 days, contact your Linux distribution vendor to obtain the patched kernel version and test it in a non-production environment to ensure compatibility with critical applications. Within 30 days, roll out the patched kernel across all affected systems, prioritizing endpoints in uncontrolled Wi-Fi environments, followed by internal infrastructure.

Linux Kernel CVE-2026-64536

EUVD-2026-49114 HIGH

2026-07-27 Linux

GHSA-rwmp-xmg8-8r93

Information Disclosure Linux

8.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.1 HIGH

Adjacent rogue AP with no auth/UI (AV:A/PR:N/UI:N); OOB read yields limited memory disclosure (C:L, not H) but reliable crash (A:H), no integrity impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 06:46 vuln.today

CVSS changed

Jul 30, 2026 - 06:37 NVD

8.1 (HIGH)

Patch available

Jul 27, 2026 - 09:01 EUVD

CVE Published

Jul 27, 2026 - 06:36 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 06:36 cve.org

HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload:

pIE->element_id and pIE->length are read without checking that

i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the buffer causes an OOB read.

For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12,

which requires pIE->length >= 16. For WLAN_EID_RSN it compares pIE->data + 8, requiring pIE->length >= 12. Neither requirement is checked.

Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE->length minimum, matching the pattern established in update_beacon_info().

AnalysisAI

Out-of-bounds kernel memory reads in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allow a malicious or spoofed access point within radio range to leak adjacent kernel memory or crash the system by sending beacon/probe-response frames carrying truncated or undersized information elements (IEs). The flaw lives in is_ap_in_tkip(), which parses IEs without bounds-checking the IE header or payload length before dereferencing WLAN_EID_VENDOR_SPECIFIC (needs length >= 16) and WLAN_EID_RSN (needs length >= 12) data. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile), and the issue is not listed in CISA KEV.

Technical ContextAI

The affected code is the rtl8723bs driver in the Linux kernel staging tree, a mainline-in-progress driver for Realtek RTL8723BS SDIO 802.11n Wi-Fi chips found in low-cost SBCs, tablets, and TV boxes. The root cause is CWE-125 (Out-of-bounds Read): is_ap_in_tkip() walks the variable-length IE list of a management frame and reads pIE->element_id and pIE->length without first confirming that i + sizeof(*pIE) <= ie_length, so a truncated final IE is dereferenced past the buffer. It then reads pIE->data+12 (vendor-specific) and pIE->data+8 (RSN) without verifying pIE->length, reading beyond the declared IE payload. The fix adds explicit IE-header and per-branch payload length guards, mirroring the safe pattern already used in update_beacon_info(). Because IE contents in beacons and probe responses are fully attacker-controlled by whoever operates the AP, the parser trusts unauthenticated over-the-air input.

RemediationAI

Apply the vendor kernel update: Patch available per vendor advisory, with fixed versions in each stable series - upgrade to at least 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or mainline 7.2-rc3 (or later) as appropriate to your branch, tracked via the stable git commits at https://git.kernel.org/stable/c/ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7 and the related backport commits. If you cannot patch immediately, the most effective compensating control is to unload or disable the driver on systems that do not need this Realtek adapter (blacklist the r8723bs/rtl8723bs module), which fully removes exposure at the cost of losing Wi-Fi on that chipset. Where the adapter is required, reduce exposure by keeping the interface down when not in use and avoiding association with untrusted or open Wi-Fi networks in hostile RF environments, accepting reduced connectivity convenience. Consult the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-64536) and VulDB entry (https://vuldb.com/vuln/383390) for cross-references.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64536 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64536

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code