---
id: CVE-2026-64440
title: >-
  kernel: staging: rtl8723bs: fix OOB write in HT_caps_handler()
  (CVE-2026-64440)
summary: >-
  A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. A remote
  attacker, by operating a malicious Access Point (AP), can send a specially
  crafted 802.11 AssocResponse frame. This can trigger an out-of-bounds write
  vulnerability …
severity: low
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe: CWE-787
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    37f642d47c3648a707df3ceb092eee1adffbfd28
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    8c872b47c7fc32e95e0da1db7512388794adcd69
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    918537a0fbed85aab61fa28ad75e6279070610c9
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    6f91621fc45025ad3c0be796b70e6e4cee22fc69
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    f8001e1a516ba3b495728c65b61f799cbfad6bd0
  - Linux 4.12
published: '2026-07-25'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T23:44:41+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64440.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64440.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64440'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507253'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64440'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64440'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64440-7b48@gregkh/T
  - url: 'https://git.kernel.org/stable/c/37f642d47c3648a707df3ceb092eee1adffbfd28'
  - url: 'https://git.kernel.org/stable/c/8c872b47c7fc32e95e0da1db7512388794adcd69'
  - url: 'https://git.kernel.org/stable/c/bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a'
  - url: 'https://git.kernel.org/stable/c/918537a0fbed85aab61fa28ad75e6279070610c9'
  - url: 'https://git.kernel.org/stable/c/6f91621fc45025ad3c0be796b70e6e4cee22fc69'
  - url: 'https://git.kernel.org/stable/c/225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d'
  - url: 'https://git.kernel.org/stable/c/f8001e1a516ba3b495728c65b61f799cbfad6bd0'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00267
epssPercentile: 0.18711
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:40:46.718780Z'
ingestedAt: '2026-10-16T17:24:46.820Z'
---

## Overview

A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. A remote attacker, by operating a malicious Access Point (AP), can send a specially crafted 802.11 AssocResponse frame. This can trigger an out-of-bounds write vulnerability in the `HT_caps_handler()` function, leading to memory corruption. This memory corruption could allow an attacker to cause a denial of service or potentially execute arbitrary code.

## Vendor advisories

- **Red Hat VEX** · Low · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64440.json)

**kernel: staging: rtl8723bs: fix OOB write in HT_caps_handler()** — rated Low by Red Hat. Released 2026-07-25, updated 2026-10-19.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

## Remediation

Refer to the advisory for fix availability.