{"id":"CVE-2026-64441","title":"kernel: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (CVE-2026-64441)","summary":"A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. This vulnerability involves out-of-bounds reads in several functions responsible for parsing information elements (IE) and attributes. Due to missing checks on the size of in…","severity":"low","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":"CWE-125","vendor":"Red Hat","product":"Linux","affected":["Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < efa27d487abcdec79669a60a6d94d5d6eceb7c1d","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 2ea1ce30ead61589214240e8d33d96310fd613e5","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < b27ecba3196f6c14e3809595ebd69c0c2392512a","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 4b51ee8a40fe47864197d73cc02b191de7a6b072","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 729c4e72563bda0f1725db1db9ea08df06f41d9b","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344","Linux 4.12"],"published":"2026-07-25","updated":"2026-10-19","sourceUpdated":"2026-10-19T23:44:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64441.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64441.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64441"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507030"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64441"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64441"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072539-CVE-2026-64441-0694@gregkh/T"},{"url":"https://git.kernel.org/stable/c/efa27d487abcdec79669a60a6d94d5d6eceb7c1d"},{"url":"https://git.kernel.org/stable/c/2ea1ce30ead61589214240e8d33d96310fd613e5"},{"url":"https://git.kernel.org/stable/c/b27ecba3196f6c14e3809595ebd69c0c2392512a"},{"url":"https://git.kernel.org/stable/c/6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c"},{"url":"https://git.kernel.org/stable/c/4b51ee8a40fe47864197d73cc02b191de7a6b072"},{"url":"https://git.kernel.org/stable/c/729c4e72563bda0f1725db1db9ea08df06f41d9b"},{"url":"https://git.kernel.org/stable/c/1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00257,"epssPercentile":0.17287,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:40:49.431069Z"},"ingestedAt":"2026-10-16T17:24:46.825Z","slug":"CVE-2026-64441","body":"## Overview\n\nA flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. This vulnerability involves out-of-bounds reads in several functions responsible for parsing information elements (IE) and attributes. Due to missing checks on the size of incoming data, these functions can read beyond the intended memory boundaries. This could allow an attacker to gain access to sensitive information from the system's memory.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64441.json)\n\n**kernel: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()** — rated Low by Red Hat. Released 2026-07-25, updated 2026-10-19.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225845,"id":"CVE-2026-64441","ts":1792498481692,"field":"severity","old":"high","new":"low"}]}