IT

Tracker / CVE-2026-64443

CVE-2026-64443

High 8.1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->length from one byte past the allocated receive buffer. Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1. Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2. Break if the IE's declared data extends past len. Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.

Affected products and versions

linux linux_kernel
linux linux_kernel · 4.12 → 5.15.212
linux linux_kernel · 5.16 → 6.1.178
linux linux_kernel · 6.13 → 6.18.39
linux linux_kernel · 6.19 → 7.1.4
linux linux_kernel · 6.2 → 6.6.145
linux linux_kernel · 6.7 → 6.12.96

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References