EUVD-2026-64586
GHSA-3j7p-mfvr-mgx3
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network vector confirmed; no credentials or interaction required; overflow enables full kernel memory write, disclosure, and crash.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix missing shared-key auth challenge length check
The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer.
In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory.
The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.
AnalysisAI
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target device must have the rtl8723bs staging driver loaded and active, which requires Realtek RTL8723BS WiFi hardware. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.8 and reflects a realistic threat model: the attack requires only WiFi radio adjacency, no credentials, and no user interaction beyond the device's normal connection attempt to a WEP AP. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within WiFi radio range of a device using the rtl8723bs driver sets up a rogue access point advertising WEP shared-key authentication on the same SSID the target device expects. When the target initiates the WEP shared-key handshake, the attacker's rogue AP responds with a crafted WLAN_EID_CHALLENGE element whose length field is set to 255 rather than the standard 128 bytes. … |
| Remediation | The primary remediation is to upgrade to a patched Linux stable release: 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2, per EUVD-2026-64586 and the fix commits at https://git.kernel.org/stable/c/39ae1033071001af9bb4573ebdbb43bbbe88f749 and associated stable-branch commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and devices using the rtl8723bs WiFi driver across your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today