GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64536 (GCVE-0-2026-64536)

Vulnerability from cvelistv5 – Published: 2026-07-27 06:36 – Updated: 2026-08-17 04:57
VLAI
Title
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE->element_id and pIE->length are read without checking that i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the buffer causes an OOB read. - For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12, which requires pIE->length >= 16. For WLAN_EID_RSN it compares pIE->data + 8, requiring pIE->length >= 12. Neither requirement is checked. Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE->length minimum, matching the pattern established in update_beacon_info().
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < d2055332297e24c63fffda943ef7a5eefc0a6019 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 6f26cc55affd9d7f88ae2f5d12db4ecf9072c209 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 204b22c8df115370037248859bf0fa62db73a396 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 4380b3860d887a13555ff024a58dfc05b490dfd6 (git)
Affected: 554c0a3abf216c991c5ebddcdb2c08689ecd290b , < 3bf39f711ff27c64be8680a8938bcc5001982e81 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_wlan_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "d2055332297e24c63fffda943ef7a5eefc0a6019",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "6f26cc55affd9d7f88ae2f5d12db4ecf9072c209",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "204b22c8df115370037248859bf0fa62db73a396",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "4380b3860d887a13555ff024a58dfc05b490dfd6",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "3bf39f711ff27c64be8680a8938bcc5001982e81",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_wlan_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop\n\nThe loop in is_ap_in_tkip() iterates over IEs without verifying that\nenough bytes remain before dereferencing the IE header or its payload:\n\n- pIE-\u003eelement_id and pIE-\u003elength are read without checking that\n  i + sizeof(*pIE) \u003c= ie_length, so a truncated IE at the end of the\n  buffer causes an OOB read.\n\n- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE-\u003edata + 12,\n  which requires pIE-\u003elength \u003e= 16.  For WLAN_EID_RSN it compares\n  pIE-\u003edata + 8, requiring pIE-\u003elength \u003e= 12.  Neither requirement\n  is checked.\n\nAdd the missing IE header and payload bounds checks and guard each\ndata access with an explicit pIE-\u003elength minimum, matching the\npattern established in update_beacon_info()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A nearby malicious WiFi access point can supply crafted beacon or probe-response IEs that reach the vulnerable association path over the air.\nAC:L - The attacker directly controls the malformed IE lengths and contents, and exploitation requires neither a race nor conditions outside the attacker\u0027s control.\nPR:N - The vulnerable code executes before WPA credentials are verified; transmitting management frames as a malicious or spoofed AP requires no privileges on the target.\nUI:N - An attacker impersonating a configured AP can trigger the path during automatic connection or reconnection without contemporaneous user action.\nS:U - The vulnerable driver and affected kernel resources belong to the same host security authority, with no demonstrated VM, sandbox, or IOMMU boundary crossing.\nC:H - The unchecked IE-header and fixed-offset comparisons read beyond attacker-declared buffer boundaries into adjacent kernel memory; under the required conservative OOB-read rule, confidentiality impact is high.\nI:N - The flaw performs reads and comparisons only, with no memory write or demonstrated data-modification primitive.\nA:H - Malformed IEs can cause kernel out-of-bounds accesses during association and potentially fault or oops the kernel; a nearby attacker can repeat the exchange."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:12.274Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2055332297e24c63fffda943ef7a5eefc0a6019"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f26cc55affd9d7f88ae2f5d12db4ecf9072c209"
        },
        {
          "url": "https://git.kernel.org/stable/c/204b22c8df115370037248859bf0fa62db73a396"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395"
        },
        {
          "url": "https://git.kernel.org/stable/c/4380b3860d887a13555ff024a58dfc05b490dfd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bf39f711ff27c64be8680a8938bcc5001982e81"
        }
      ],
      "title": "staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64536",
    "datePublished": "2026-07-27T06:36:04.736Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-08-17T04:57:12.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64536",
      "date": "2026-09-16",
      "epss": "0.00249",
      "percentile": "0.16447"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64536\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-27T08:16:22.890\",\"lastModified\":\"2026-08-17T05:17:58.493\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstaging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop\\n\\nThe loop in is_ap_in_tkip() iterates over IEs without verifying that\\nenough bytes remain before dereferencing the IE header or its payload:\\n\\n- pIE-\u003eelement_id and pIE-\u003elength are read without checking that\\n  i + sizeof(*pIE) \u003c= ie_length, so a truncated IE at the end of the\\n  buffer causes an OOB read.\\n\\n- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE-\u003edata + 12,\\n  which requires pIE-\u003elength \u003e= 16.  For WLAN_EID_RSN it compares\\n  pIE-\u003edata + 8, requiring pIE-\u003elength \u003e= 12.  Neither requirement\\n  is checked.\\n\\nAdd the missing IE header and payload bounds checks and guard each\\ndata access with an explicit pIE-\u003elength minimum, matching the\\npattern established in update_beacon_info().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/staging/rtl8723bs/core/rtw_wlan_util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"d2055332297e24c63fffda943ef7a5eefc0a6019\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"6f26cc55affd9d7f88ae2f5d12db4ecf9072c209\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"204b22c8df115370037248859bf0fa62db73a396\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"4380b3860d887a13555ff024a58dfc05b490dfd6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"554c0a3abf216c991c5ebddcdb2c08689ecd290b\",\"lessThan\":\"3bf39f711ff27c64be8680a8938bcc5001982e81\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/staging/rtl8723bs/core/rtw_wlan_util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/204b22c8df115370037248859bf0fa62db73a396\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3bf39f711ff27c64be8680a8938bcc5001982e81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4380b3860d887a13555ff024a58dfc05b490dfd6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f26cc55affd9d7f88ae2f5d12db4ecf9072c209\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d2055332297e24c63fffda943ef7a5eefc0a6019\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-05T12:42:06+00:00",
      "cve": "CVE-2026-64536",
      "id": "CVE-2026-64536",
      "initial_release_date": "2026-07-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64536.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:46:33Z",
      "cve": "CVE-2026-64536",
      "id": "CVE-2026-64536",
      "initial_release_date": "2026-07-27T16:59:59Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "669",
      "product_status:known_not_affected": "80",
      "product_status:recommended": "46",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64536",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64536.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.