CVE-2026-64441

What it actually does

This is an out-of-bounds read vulnerability in the Linux kernel staging driver for Realtek RTL8723BS wireless devices. Several 802.11 information-element parsing routines fail to verify that enough bytes remain in a received buffer before reading element headers, WPA/WAPI OUIs, or WPS attribute fields. A nearby attacker within Wi-Fi radio range can send malformed wireless management/probe/beacon/association-related frames that trigger unsafe reads in kernel context. Depending on kernel build, memory layout, and hardening features, this can cause a kernel crash, information exposure, or potentially contribute to further memory-corruption exploitation.

Why it matters to the business

Systems using affected Linux kernels with the rtl8723bs wireless driver enabled may be disrupted by an attacker physically nearby, without credentials or user interaction. The most likely operational impact is device instability or denial of service on laptops, tablets, embedded devices, kiosks, IoT systems, or appliances using the affected Wi-Fi chipset. Although there is no current KEV listing, no known ransomware use, and low EPSS at publication time, the vulnerability has a high CVSS score because exploitation is unauthenticated and occurs in kernel-space code over a local wireless attack surface.

How an attack unfolds

An attacker positions themselves within Wi-Fi range of a device using the affected RTL8723BS driver. They transmit crafted 802.11 frames containing truncated or malformed WPA, WAPI, or WPS information elements. When the Linux kernel driver receives and parses these fields, the vulnerable routines read past the end of the supplied buffer because they assume tag, length, OUI, or attribute header bytes are present. The invalid read occurs inside kernel context. In practical attacks, this may crash the kernel or wireless stack; under favorable conditions, it may expose adjacent kernel memory or be chained with additional bugs to increase exploitability. There is currently no public exploit maturity indicated and the issue is not listed in CISA KEV.

How to fix it

Apply a Linux kernel update from the operating system, device, or appliance vendor that includes the rtl8723bs bounds-checking fixes for rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr(). No specific fixed package versions were provided in the input, so rely on vendor advisories and kernel package changelogs for the exact patched build. Where immediate patching is not possible, reduce exposure by disabling Wi-Fi on affected systems, unloading or blacklisting the rtl8723bs driver if it is not required, using wired networking, restricting use of affected devices in untrusted RF environments, and enabling kernel hardening features such as KASAN/KFENCE in test builds and standard production mitigations where available.

How to confirm the fix worked

Confirm whether systems load the affected driver by checking for the rtl8723bs kernel module and matching hardware. Validate remediation by verifying the installed kernel package or vendor firmware build includes the upstream fix, and by confirming that the patched source or vendor changelog contains added length checks for the affected functions. On Linux systems, review module presence with lsmod, modinfo, dmesg, and hardware inventory tools. If the driver is not present or not loaded, practical exposure is reduced. For high-assurance validation in a lab, use controlled malformed 802.11 test frames against an unpatched and patched device and confirm the patched system no longer produces crashes, KASAN findings, or kernel oops messages during rtl8723bs parsing.

Typical attack path

1. Identify nearby devices using Linux with the Realtek RTL8723BS wireless driver or broadly target devices likely to contain that chipset.
2. Set up a wireless transmitter capable of injecting crafted 802.11 management frames.
3. Create malformed WPA, WAPI, or WPS information elements with lengths shorter than the parser expects.
4. Transmit the crafted frames within radio range of the target device.
5. Trigger the vulnerable rtl8723bs parsing routines as the target wireless interface processes nearby Wi-Fi frames.
6. Cause kernel memory to be read out of bounds, potentially resulting in device crash, driver failure, information exposure, or a stepping stone for further exploitation.

How to detect it

Post-exploitation detection should focus on signs of kernel instability or memory-safety failures in systems using the rtl8723bs driver. Review kernel logs, persistent journal logs, crash dumps, pstore/ramoops records, endpoint telemetry, and wireless event logs for crashes or warnings involving rtl8723bs, Realtek wireless handling, malformed 802.11 frames, or KASAN out-of-bounds-read reports. Since exploitation occurs over Wi-Fi and may not leave application-layer logs, network detection requires wireless monitoring capable of capturing 802.11 management frames and identifying malformed WPA, WAPI, or WPS information elements with inconsistent or truncated lengths. Look for temporal correlation between nearby wireless activity and kernel oops, panic, driver reset, interface drop, or unexplained reboot events. There are no named threat actors or known in-the-wild campaigns provided for this issue, so detection should emphasize behavioral evidence rather than actor-specific infrastructure.

• rtl8723bs
• rtw_get_sec_ie
• rtw_get_wapi_ie
• rtw_get_wps_attr
• BUG: KASAN: out-of-bounds
• out-of-bounds read
• kernel BUG
• Oops:
• Kernel panic
• general protection fault
• rtl8723bs:
• Realtek RTL8723BS
• wlan0: deauthenticating
• wlan0: disassociated
• /sys/module/rtl8723bs
• /lib/modules/*/kernel/drivers/staging/rtl8723bs
• 8723bs.ko

What your security team should do

• Prioritize inventory of Linux laptops, tablets, embedded systems, and appliances that use the Realtek RTL8723BS wireless chipset or load the rtl8723bs driver.
• Patch affected kernels through the appropriate OS or device vendor update channel as soon as tested, especially for devices used in public, shared, or hostile wireless environments.
• If patching is delayed, disable Wi-Fi or blacklist the rtl8723bs module on systems where wireless connectivity is not business-critical.
• Monitor kernel logs and endpoint telemetry for crashes, KASAN reports, oops events, or wireless driver resets involving rtl8723bs after exposure to untrusted Wi-Fi environments.
• For managed fleets, add driver/module presence to vulnerability management queries so systems can be prioritized based on actual exposure rather than kernel version alone.
• Because exploitation requires radio proximity, coordinate with physical security and operations for high-risk locations such as public kiosks, branch offices, manufacturing floors, healthcare devices, and travel devices.