Answer in brief
CVE-2026-64446 records a Unknown severity vulnerability in staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-64446 records a Unknown severity vulnerability in staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <a94a643a80a84ceb8139061c3d6bf988d75e45a5 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <2131621986c62c86109ce4d84cf73a73757eb8a6 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <6f20d7b0ee47c470734a69379b0fc6647c519603 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <5d7812360abf3143afcbf5efe4ef242448fa1f28 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <46f66c16a95191d9aca07a72ae6b1252a244e26c || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <b9c4bf133c3c47e23baf4f5403b98a953bf58606 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <138cd190efd56ab36c9fdd8fef8749d06937f24b || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <5a752a616e756844388a1a45404db9fc29fec655 | a94a643a80a84ceb8139061c3d6bf988d75e45a5, 2131621986c62c86109ce4d84cf73a73757eb8a6, 6f20d7b0ee47c470734a69379b0fc6647c519603, 5d7812360abf3143afcbf5efe4ef242448fa1f28, 46f66c16a95191d9aca07a72ae6b1252a244e26c, b9c4bf133c3c47e23baf4f5403b98a953bf58606, 138cd190efd56ab36c9fdd8fef8749d06937f24b, 5a752a616e756844388a1a45404db9fc29fec655 |
| Linux/Linuxgeneric | 4.12 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <a94a643a80a84ceb8139061c3d6bf988d75e45a5 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <2131621986c62c86109ce4d84cf73a73757eb8a6 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <6f20d7b0ee47c470734a69379b0fc6647c519603 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <5d7812360abf3143afcbf5efe4ef242448fa1f28 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <46f66c16a95191d9aca07a72ae6b1252a244e26c || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <b9c4bf133c3c47e23baf4f5403b98a953bf58606 || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <138cd190efd56ab36c9fdd8fef8749d06937f24b || >=554c0a3abf216c991c5ebddcdb2c08689ecd290b <5a752a616e756844388a1a45404db9fc29fec655 | a94a643a80a84ceb8139061c3d6bf988d75e45a5, 2131621986c62c86109ce4d84cf73a73757eb8a6, 6f20d7b0ee47c470734a69379b0fc6647c519603, 5d7812360abf3143afcbf5efe4ef242448fa1f28, 46f66c16a95191d9aca07a72ae6b1252a244e26c, b9c4bf133c3c47e23baf4f5403b98a953bf58606, 138cd190efd56ab36c9fdd8fef8749d06937f24b, 5a752a616e756844388a1a45404db9fc29fec655 |
| Linux/Linuxgeneric | 4.12 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
Quoted source text, attributed separately from HOL analysis.