CVE-2026-64443 Details

A vulnerability allowing an out-of-bounds read has been identified in the Linux kernel's RTL8723BS Wi-Fi driver, specifically within the 'update_beacon_info' function. This issue arises because the Information Element (IE) parsing loop advances by the length of the IE plus two bytes for each iteration, but only checks that the index is less than the total length of the packet. As a result, when a malicious Access Point (AP) sends a Beacon frame with a last IE that leaves only one byte remaining (with the element ID byte positioned at the last index), the loop can read the IE length from beyond the allocated buffer. Furthermore, even if the header bytes are within bounds, the declared length can still truncate the IE, passing incomplete data to the handler functions. The vulnerability has been addressed by adding two safeguards at the beginning of the loop: one to ensure that enough bytes remain to read the header, and another to verify that the IE's declared data does not exceed the length of the packet. Additionally, the loop increment has been modified for consistency with the new safeguards.

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.