CVE-2026-64446

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.

Is your site exposed to CVE-2026-64446?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0023

Probability of exploitation

0.14%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6 https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655 https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28 https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603 https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5 https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606

Frequently Asked Questions

What is CVE-2026-64446? +

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.

How do I check if I'm vulnerable to CVE-2026-64446? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.