{"id":"CVE-2026-64440","title":"kernel: staging: rtl8723bs: fix OOB write in HT_caps_handler() (CVE-2026-64440)","summary":"A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. A remote attacker, by operating a malicious Access Point (AP), can send a specially crafted 802.11 AssocResponse frame. This can trigger an out-of-bounds write vulnerability …","severity":"low","cvss":8.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":"CWE-787","vendor":"Red Hat","product":"Linux","affected":["Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 37f642d47c3648a707df3ceb092eee1adffbfd28","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 8c872b47c7fc32e95e0da1db7512388794adcd69","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 918537a0fbed85aab61fa28ad75e6279070610c9","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 6f91621fc45025ad3c0be796b70e6e4cee22fc69","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < f8001e1a516ba3b495728c65b61f799cbfad6bd0","Linux 4.12"],"published":"2026-07-25","updated":"2026-10-19","sourceUpdated":"2026-10-19T23:44:41+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64440.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64440.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64440"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507253"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64440"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64440"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64440-7b48@gregkh/T"},{"url":"https://git.kernel.org/stable/c/37f642d47c3648a707df3ceb092eee1adffbfd28"},{"url":"https://git.kernel.org/stable/c/8c872b47c7fc32e95e0da1db7512388794adcd69"},{"url":"https://git.kernel.org/stable/c/bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a"},{"url":"https://git.kernel.org/stable/c/918537a0fbed85aab61fa28ad75e6279070610c9"},{"url":"https://git.kernel.org/stable/c/6f91621fc45025ad3c0be796b70e6e4cee22fc69"},{"url":"https://git.kernel.org/stable/c/225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d"},{"url":"https://git.kernel.org/stable/c/f8001e1a516ba3b495728c65b61f799cbfad6bd0"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00267,"epssPercentile":0.18711,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:40:46.718780Z"},"ingestedAt":"2026-10-16T17:24:46.820Z","slug":"CVE-2026-64440","body":"## Overview\n\nA flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. A remote attacker, by operating a malicious Access Point (AP), can send a specially crafted 802.11 AssocResponse frame. This can trigger an out-of-bounds write vulnerability in the `HT_caps_handler()` function, leading to memory corruption. This memory corruption could allow an attacker to cause a denial of service or potentially execute arbitrary code.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64440.json)\n\n**kernel: staging: rtl8723bs: fix OOB write in HT_caps_handler()** — rated Low by Red Hat. Released 2026-07-25, updated 2026-10-19.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225846,"id":"CVE-2026-64440","ts":1792498482201,"field":"severity","old":"high","new":"low"}]}