---
id: CVE-2026-64442
title: >-
  kernel: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
  join_cmd_hdl() (CVE-2026-64442)
summary: >-
  A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. Insufficient
  boundary checks in the information element (IE) parsing loops within the
  `issue_assocreq()` and `join_cmd_hdl()` functions allow a remote attacker to
  cause an ou…
severity: low
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
cwe: CWE-125
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    bc881c9915c4468747d0ca5fd1abd7b313cfb0f4
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    605ebd94d0f469204f3c9f2f84acc71e43e2780f
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    a830bdc82461353bf7b1f8a2ad2689bf5d2de444
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    4c21eec80cf502d9ea18e0b946246b2376452786
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    c38d16b1ffac385c9e4b38447cd5c46af1114b58
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    402f13ec95945f34a210b28df1f8740d3d4a58c5
  - >-
    Linux >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b <
    ef61d628dfad38fead1fd2e08979ae9126d011d5
  - Linux 4.12
published: '2026-07-25'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T23:44:41+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64442.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64442.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64442'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507269'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64442'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64442'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072539-CVE-2026-64442-7060@gregkh/T
  - url: 'https://git.kernel.org/stable/c/bc881c9915c4468747d0ca5fd1abd7b313cfb0f4'
  - url: 'https://git.kernel.org/stable/c/605ebd94d0f469204f3c9f2f84acc71e43e2780f'
  - url: 'https://git.kernel.org/stable/c/a830bdc82461353bf7b1f8a2ad2689bf5d2de444'
  - url: 'https://git.kernel.org/stable/c/4c21eec80cf502d9ea18e0b946246b2376452786'
  - url: 'https://git.kernel.org/stable/c/ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e'
  - url: 'https://git.kernel.org/stable/c/c38d16b1ffac385c9e4b38447cd5c46af1114b58'
  - url: 'https://git.kernel.org/stable/c/402f13ec95945f34a210b28df1f8740d3d4a58c5'
  - url: 'https://git.kernel.org/stable/c/ef61d628dfad38fead1fd2e08979ae9126d011d5'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00287
epssPercentile: 0.2112
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:40:51.646471Z'
ingestedAt: '2026-10-16T17:24:46.821Z'
---

## Overview

A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. Insufficient boundary checks in the information element (IE) parsing loops within the `issue_assocreq()` and `join_cmd_hdl()` functions allow a remote attacker to cause an out-of-bounds read. By sending specially crafted, truncated IE data from a malicious Wi-Fi Access Point, an attacker could trigger a system crash, leading to a denial of service.

## Vendor advisories

- **Red Hat VEX** · Low · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64442.json)

**kernel: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()** — rated Low by Red Hat. Released 2026-07-25, updated 2026-10-19.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

## Remediation

Refer to the advisory for fix availability.