CVE-2026-64445

What it actually does

This flaw is in the Linux kernel staging driver for Realtek RTL8723BS wireless adapters. In the WEP shared-key authentication handling path, the driver can process malformed 802.11 authentication frames without first validating that the frame is long enough to contain the expected WEP IV and ICV fields. This can cause an integer underflow that is converted to a very large unsigned length, leading the kernel to read beyond the received frame buffer during CRC processing. A second issue allows the driver to compare 128 bytes of challenge text even when the Challenge Text information element is shorter than 128 bytes, causing another out-of-bounds read. Because this occurs in kernel context and can be triggered by unauthenticated adjacent wireless traffic, exploitation can plausibly cause kernel crashes, memory disclosure, or other high-impact system compromise depending on platform behavior and memory layout.

Why it matters to the business

Systems using the affected Linux kernel driver on wireless-enabled devices may be vulnerable to attacks from someone within radio range, without needing credentials or user interaction. Successful exploitation could disrupt device availability through kernel crashes, expose sensitive kernel memory, or potentially support deeper compromise of the affected device. The risk is most relevant for laptops, embedded Linux systems, IoT devices, kiosks, industrial endpoints, and other equipment using RTL8723BS Wi-Fi hardware. Although this issue is not currently listed in CISA KEV and has low EPSS at 0.00316 with no public exploit maturity reported, the vulnerability is newly published and has a high CVSS score, so organizations with exposed wireless fleets should prioritize identification and patching.

How an attack unfolds

An attacker must be within wireless range of a vulnerable device using the affected RTL8723BS driver. The attacker crafts malformed IEEE 802.11 shared-key authentication frames. One exploit path sets the Privacy bit on a frame that is too short to contain the required WEP IV and ICV fields, causing the kernel driver to calculate a negative effective length and pass it into CRC validation as a large unsigned size, resulting in an out-of-bounds kernel memory read. Another path sends a sequence-3 authentication response with a Challenge Text information element whose declared length is not the required 128 bytes; the vulnerable code still compares 128 bytes, reading beyond the supplied element. The immediate observable result is likely a kernel oops, panic, Wi-Fi driver instability, or device reboot, though the high impact rating indicates that confidentiality and integrity impacts should also be considered possible until patched.

How to fix it

Update the Linux kernel to a version that includes the upstream fix for the RTL8723BS OnAuth() length validation issues. Because no exact fixed package versions were provided, use vendor advisories for the relevant Linux distribution, appliance vendor, or embedded firmware supplier to identify the corrected kernel package or firmware image. Where immediate patching is not possible, reduce exposure by disabling the rtl8723bs/r8723bs driver if the hardware is not required, disabling Wi-Fi on affected devices, using wired networking, blocking or restricting WEP/shared-key authentication use, and limiting affected devices in areas where untrusted radio proximity is possible. Since this is a kernel-space wireless driver issue, application-layer controls will not mitigate the vulnerable parsing path.

How to confirm the fix worked

Confirm remediation by verifying that affected systems are running a kernel or vendor firmware build that includes the rtl8723bs OnAuth() fix. Inventory systems for RTL8723BS hardware and the loaded r8723bs/rtl8723bs module, then compare kernel package versions against vendor security advisories. On Linux, check loaded modules with lsmod, hardware presence with lspci/lsusb or platform inventory tooling, and kernel package/build information with uname and the distribution package manager. For exposure validation, confirm whether the vulnerable driver is present and active, whether Wi-Fi is enabled, and whether the device operates in locations where untrusted wireless proximity is plausible. For security testing, use only authorized lab equipment to replay malformed 802.11 authentication frames and confirm that patched systems reject them without kernel oops, panic, driver reset, or abnormal logs.

Typical attack path

1. Identify a target device within Wi-Fi radio range that uses a vulnerable Linux kernel build with the RTL8723BS staging driver enabled.
2. Place a wireless interface in monitor or injection mode and craft 802.11 authentication frames for WEP shared-key authentication.
3. Send a malformed protected authentication frame that is shorter than the required WEP IV/ICV minimum length, or send a sequence-3 response with an invalid Challenge Text IE length.
4. Trigger the vulnerable OnAuth() handling path in the kernel driver as it processes the malformed management frame.
5. Cause an out-of-bounds read in kernel context, potentially resulting in a kernel oops, panic, device reboot, memory exposure, or other compromise depending on platform conditions.

How to detect it

Retrospective detection is difficult because exploitation occurs through 802.11 wireless management frames, which are often not logged by the endpoint and may never traverse normal network monitoring infrastructure. Review Linux kernel logs, system journal entries, crash dumps, and device telemetry for kernel oops, panic, page fault, general protection fault, driver reset, or unexpected reboot events involving the rtl8723bs/r8723bs driver, OnAuth(), rtw_wep_decrypt(), crc32_le(), or memcmp() around periods of Wi-Fi activity. If wireless packet captures are available from monitor-mode sensors, look for malformed authentication frames associated with WEP shared-key authentication, especially protected authentication frames shorter than the minimum WEP IV/ICV length requirement, or authentication transaction sequence 3 frames where the Challenge Text information element length is not exactly 128 bytes. In suspected incidents, correlate device crash times with local wireless monitoring, physical proximity events, helpdesk reports of Wi-Fi instability, and repeated authentication management frames from unknown transmitter MAC addresses. Absence of logs does not rule out exploitation, because malformed frames may only produce a reboot or transient kernel fault without durable telemetry.

• rtl8723bs
• r8723bs
• rtw_wep_decrypt
• OnAuth
• crc32_le
• RIP: rtw_wep_decrypt
• Call Trace: rtw_wep_decrypt
• Call Trace: OnAuth
• kernel panic.*rtl8723bs
• Oops.*rtl8723bs
• general protection fault.*rtl8723bs
• BUG: unable to handle kernel paging request.*rtw_wep_decrypt
• wlan.fc.type_subtype == 0x0b && wlan.fc.protected == 1 && frame.len < 32
• wlan.fixed.auth_seq == 3 && wlan.tag.number == 16 && wlan.tag.length != 128

What your security team should do

• Prioritize asset discovery for Linux systems, embedded devices, and appliances using Realtek RTL8723BS Wi-Fi hardware or the r8723bs/rtl8723bs kernel driver.
• Patch affected kernels or vendor firmware as soon as fixed packages are available, prioritizing mobile, public-facing, operational, and difficult-to-monitor wireless devices.
• If patching is delayed, disable the affected wireless driver or Wi-Fi interface where operationally feasible.
• Monitor kernel logs for oops, panic, page fault, or call trace entries involving rtl8723bs, r8723bs, OnAuth, rtw_wep_decrypt, crc32_le, or memcmp during Wi-Fi activity.
• Capture and review wireless management traffic in high-risk locations if exploitation is suspected, especially malformed authentication frames with the Protected/Privacy bit set and abnormally short frame lengths.
• Review incident response procedures for wireless-adjacent kernel driver exploitation, including preservation of kernel logs, crash dumps, and nearby wireless packet captures.