{"id":"CVE-2026-64536","title":"kernel: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (CVE-2026-64536)","summary":"A flaw was found in the Linux kernel rtl8723bs staging Wi-Fi driver. is_ap_in_tkip() reads an information-element header and its vendor or RSN payload without checking that those bytes remain in the buffer, so a truncated element causes an…","severity":"low","cvss":8.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","cwe":"CWE-125","vendor":"Red Hat","product":"Linux","affected":["Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < d2055332297e24c63fffda943ef7a5eefc0a6019","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 6f26cc55affd9d7f88ae2f5d12db4ecf9072c209","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 204b22c8df115370037248859bf0fa62db73a396","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 4380b3860d887a13555ff024a58dfc05b490dfd6","Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 3bf39f711ff27c64be8680a8938bcc5001982e81","Linux 4.12"],"published":"2026-07-27","updated":"2026-10-19","sourceUpdated":"2026-10-19T23:44:52+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64536.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64536.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64536"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507403"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64536"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64536"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072757-CVE-2026-64536-3376@gregkh/T"},{"url":"https://git.kernel.org/stable/c/ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7"},{"url":"https://git.kernel.org/stable/c/d2055332297e24c63fffda943ef7a5eefc0a6019"},{"url":"https://git.kernel.org/stable/c/6f26cc55affd9d7f88ae2f5d12db4ecf9072c209"},{"url":"https://git.kernel.org/stable/c/204b22c8df115370037248859bf0fa62db73a396"},{"url":"https://git.kernel.org/stable/c/a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395"},{"url":"https://git.kernel.org/stable/c/4380b3860d887a13555ff024a58dfc05b490dfd6"},{"url":"https://git.kernel.org/stable/c/3bf39f711ff27c64be8680a8938bcc5001982e81"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00259,"epssPercentile":0.17456,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:41:58.313988Z"},"ingestedAt":"2026-10-16T17:24:46.827Z","slug":"CVE-2026-64536","body":"## Overview\n\nA flaw was found in the Linux kernel rtl8723bs staging Wi-Fi driver. is_ap_in_tkip() reads an information-element header and its vendor or RSN payload without checking that those bytes remain in the buffer, so a truncated element causes an out-of-bounds read.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64536.json)\n\n**kernel: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop** — rated Low by Red Hat. Released 2026-07-27, updated 2026-10-19.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225841,"id":"CVE-2026-64536","ts":1792498479077,"field":"severity","old":"high","new":"low"}]}