CVE-2026-64444

What it actually does

This is an out-of-bounds read in the Linux kernel staging Realtek rtl8723bs wireless driver. When parsing 802.11 Association Response information elements, the driver can read one byte past the received frame buffer if a malicious or malformed access point sends a truncated final information element. A second related bounds issue can allow a declared information element length to extend beyond the actual packet. Because the parsing occurs in kernel context, exploitation can expose adjacent kernel memory and may also trigger a kernel fault or system crash. The attack vector is adjacent-network: the attacker must be within wireless range or otherwise able to cause the device to process a crafted Wi-Fi association response.

Why it matters to the business

Systems using the affected rtl8723bs Wi-Fi driver can be attacked over local wireless proximity without credentials or user interaction beyond normal Wi-Fi association behavior. Successful exploitation could disclose sensitive kernel memory or disrupt availability through crashes, which is most concerning for laptops, embedded Linux devices, IoT systems, kiosks, and operational devices that rely on this chipset. The issue is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score, but the CVSS severity is high because exploitation requires no authentication and occurs in kernel code.

How an attack unfolds

An attacker sets up or controls a nearby malicious Wi-Fi access point and causes a vulnerable Linux device using the rtl8723bs driver to attempt association. During the association handshake, the malicious access point sends a crafted Association Response frame where the final information element is truncated so that only the element ID byte remains, or where the element length field claims more data than is present in the frame. The vulnerable driver enters the information-element parsing loop and reads the length byte or passes a truncated information element beyond the valid receive buffer boundary. Depending on kernel memory layout and runtime conditions, this may result in disclosure of adjacent kernel memory to subsequent logic, driver instability, a kernel warning or oops, loss of Wi-Fi connectivity, or a system crash. Reliable remote code execution is not indicated by the provided details, but the bug executes in kernel context and should be treated as high risk on exposed wireless clients.

How to fix it

Upgrade to a Linux kernel version or vendor kernel package that includes the rtl8723bs OnAssocRsp() information-element bounds-checking fix. No exact fixed versions were provided in the input, so use the security advisory and package metadata from the relevant Linux distribution, device vendor, or embedded firmware supplier. Where immediate patching is not possible, reduce exposure by disabling the rtl8723bs wireless interface, unloading or blacklisting the rtl8723bs module if Wi-Fi is not required, using wired networking, preventing automatic association to untrusted networks, and limiting operation of affected devices in hostile or public wireless environments. For managed fleets, prioritize devices that use Realtek RTL8723BS/rtl8723bs Wi-Fi and that operate outside physically controlled wireless areas.

How to confirm the fix worked

Confirm remediation by verifying that the installed kernel or vendor firmware contains the upstream fix for the rtl8723bs OnAssocRsp() information-element parsing bounds checks. On Linux systems, check the running kernel version, installed kernel package changelog, and loaded modules for rtl8723bs usage. Validate that the vulnerable driver is no longer present, no longer loaded, or has been updated. If source validation is possible, confirm that the OnAssocRsp() loop breaks when fewer than a full information-element header remains and when the declared information-element length extends past pkt_len. Functional validation should include normal Wi-Fi association testing after upgrade and monitoring for kernel warnings, driver resets, or wireless instability.

Typical attack path

1. Identify devices likely using the Linux rtl8723bs wireless driver, commonly seen in some Realtek SDIO Wi-Fi chipsets and embedded Linux platforms.
2. Move within wireless range of the target device or operate a rogue access point in an area where the device may attempt to connect.
3. Advertise a network that the target will probe for or attempt to associate with, or otherwise induce association with the malicious access point.
4. Send a crafted 802.11 Association Response frame containing a malformed or truncated information element near the end of the frame.
5. Trigger the vulnerable OnAssocRsp() parsing path in the rtl8723bs driver.
6. Cause an out-of-bounds kernel read, potentially resulting in kernel memory exposure, driver malfunction, Wi-Fi disruption, kernel oops, or system crash.

How to detect it

Post-exploitation detection is difficult because the triggering packet is a low-level 802.11 management frame and may not be logged by the operating system unless it causes driver or kernel instability. Review kernel logs, system journal, crash dumps, wireless supplicant logs, endpoint uptime data, and Wi-Fi infrastructure telemetry for suspicious timing correlations: association attempts followed by rtl8723bs driver errors, kernel warnings, oops/panic events, unexplained reboots, or Wi-Fi resets. If wireless packet capture is available from sensors or monitor-mode collection, look for Association Response frames from unknown or rogue BSSIDs where the final information element is truncated or declares a length beyond the remaining frame. Investigations should also review nearby rogue access point detections, unusual SSIDs imitating trusted networks, repeated failed associations, and device crashes occurring when in public or uncontrolled wireless environments. There are no reliable file, process, registry, or network payload indicators that uniquely prove exploitation from the provided information.

What your security team should do

• Inventory Linux endpoints and embedded devices for use of the rtl8723bs/RTL8723BS wireless driver or affected vendor firmware.
• Prioritize patching or firmware updates for mobile, public-facing, kiosk, IoT, and operational devices that use Wi-Fi in uncontrolled environments.
• If a patch is unavailable, disable or blacklist the rtl8723bs driver where operationally feasible, or restrict devices to trusted physical/wireless locations.
• Disable automatic connection to open, unknown, or user-created Wi-Fi networks on affected devices.
• Monitor kernel logs and wireless telemetry for crashes, oops events, driver resets, or repeated association failures involving rtl8723bs.
• Treat suspicious wireless association events near sensitive locations as potentially relevant, especially if followed by kernel instability or device reboots.
• Track distribution and vendor advisories for exact fixed kernel package versions, since no fixed versions were provided in the input.