CVE-2026-64443

What it actually does

This is an out-of-bounds read in the Linux kernel staging driver for Realtek RTL8723BS wireless devices. The vulnerable code parses 802.11 Beacon information elements and advances through the buffer using the element length field without first confirming that both the element header and declared element data are fully inside the received frame. A nearby malicious wireless access point can send a malformed Beacon frame that causes the driver to read past the allocated receive buffer. Depending on kernel configuration and memory layout, this can disclose adjacent kernel memory to subsequent logic, trigger a kernel fault, or cause a denial of service. The attack requires wireless adjacency but does not require authentication, user interaction, or local privileges.

Why it matters to the business

Systems using the affected Linux wireless driver may be crashed or destabilized by a malicious device within Wi-Fi range, and in some conditions kernel memory may be exposed. The most likely operational impact is loss of wireless connectivity or device availability for embedded, IoT, tablet, kiosk, or edge systems that use RTL8723BS hardware. Because exploitation requires radio proximity, internet-wide exposure is limited, and the low EPSS score indicates no broad public exploitation signal at this time; however, devices deployed in public, shared, or hostile wireless environments have higher practical risk.

How an attack unfolds

An attacker positions a malicious access point or software-defined radio within wireless range of a vulnerable Linux system using the rtl8723bs driver. The attacker transmits crafted 802.11 Beacon frames containing a malformed final information element where only the element ID byte remains, or where the element length claims more bytes than remain in the frame. When the vulnerable driver receives and parses the Beacon, update_beacon_info() reads the IE length byte or processes a truncated IE beyond the receive buffer boundary. This can result in a kernel out-of-bounds read, potentially exposing adjacent memory to driver logic or causing a kernel exception, watchdog reset, or system crash. No network association or credentials are required because Beacon frames are unauthenticated management frames normally processed during scanning and roaming.

How to fix it

Apply a Linux kernel update that includes the rtl8723bs update_beacon_info() bounds-checking fix. The fixed code should break out of the IE parsing loop when fewer than a full IE header remains and when an IE’s declared data length extends past the end of the received Beacon frame. If vendor fixed kernel versions are not yet available, reduce exposure by disabling the RTL8723BS wireless interface where not required, using alternate wireless hardware/drivers, disabling automatic Wi-Fi scanning where feasible, and avoiding use of affected devices in untrusted public wireless environments. Kernel hardening features such as KASAN are useful for testing but are not a production mitigation; standard memory-hardening and crash-recovery controls may reduce impact but do not remove the vulnerability.

How to confirm the fix worked

Confirm that the running kernel package or vendor firmware includes the upstream rtl8723bs bounds-checking change in update_beacon_info(). Validate exposure by checking whether the rtl8723bs module is present or loaded, for example through kernel module listings, device inventory, or hardware enumeration. Confirm remediation by reviewing the patched source or vendor advisory for guards that verify remaining IE bytes before reading the IE header and verify that pIE->length does not extend beyond the Beacon buffer. In a controlled lab only, malformed Beacon frames can be used to confirm that a patched system ignores the truncated IE without a kernel warning, KASAN finding, driver reset, or crash.

Typical attack path

1. Identify a target device using or likely using the Realtek RTL8723BS Linux wireless driver.
2. Move within Wi-Fi radio range of the target device.
3. Transmit crafted 802.11 Beacon frames with malformed information element length fields.
4. Wait for the target wireless interface to scan or passively process nearby Beacon frames.
5. Trigger the vulnerable IE parsing path in update_beacon_info().
6. Cause an out-of-bounds kernel read that may lead to memory disclosure, driver instability, wireless disruption, or kernel crash.

How to detect it

Detection should focus on evidence of driver faults and suspicious wireless management-frame activity rather than conventional network logs, because the exploit is delivered over local 802.11 Beacon frames before normal IP communication. Review kernel logs, system journals, crash dumps, wireless driver telemetry, and endpoint monitoring for kernel warnings, KASAN reports, oopses, panics, or resets referencing rtl8723bs, update_beacon_info(), Beacon parsing, or out-of-bounds reads. Correlate events with wireless scan activity, sudden loss of Wi-Fi connectivity, repeated interface resets, or incidents occurring only in a particular physical area. If wireless sensor infrastructure is available, inspect 802.11 management-frame captures for Beacons with malformed or truncated information elements, especially frames where an IE header is incomplete or an IE length exceeds the remaining frame length. There are no known public threat actors or ransomware campaigns associated with this issue in the provided data.

• rtl8723bs
• update_beacon_info
• KASAN: slab-out-of-bounds
• KASAN: global-out-of-bounds
• BUG: KASAN
• Oops:
• kernel panic
• rtl8723bs:
• r8723bs
• Beacon
• Information Element
• IE length
• out-of-bounds read

What your security team should do

• Prioritize patching Linux systems, embedded devices, and appliances that use RTL8723BS Wi-Fi hardware, especially those operating in public or shared wireless spaces.
• Inventory endpoints and embedded devices for the rtl8723bs driver or Realtek RTL8723BS wireless chipset.
• Monitor vendor kernel and device firmware channels for fixed builds if exact fixed versions are not yet published.
• Temporarily disable unused Wi-Fi interfaces or replace affected wireless adapters on high-risk systems until patched.
• Review kernel logs for wireless-driver crashes, KASAN out-of-bounds reports, or repeated resets involving rtl8723bs.
• Treat unexplained kernel panics or wireless failures occurring in specific physical locations as potentially malicious RF activity and investigate nearby rogue access points.
• Because this is not currently listed in CISA KEV and has low EPSS, balance urgency against asset criticality and physical exposure rather than internet perimeter severity.