CVE-2026-64446

What it actually does

This is a local heap buffer overflow in the Linux kernel staging Realtek rtl8723bs wireless driver. The vulnerable function copies a user-supplied WPA/WPA2 information element into a fixed 256-byte buffer without correctly rejecting a maximum-length element; a crafted element with length 255 causes a 257-byte copy and writes one byte past the end of the buffer into adjacent driver state. Because this occurs in kernel context, successful exploitation can corrupt kernel memory and may cause a kernel crash or potentially contribute to local privilege escalation, although the described overwrite is narrow and no mature public exploit is reported.

Why it matters to the business

Systems using the affected rtl8723bs wireless driver could be destabilized by a local user or compromised local process that can initiate Wi-Fi connection requests. The most likely operational impact is endpoint or embedded-device crashes, loss of wireless connectivity, and service disruption; in higher-risk scenarios, kernel memory corruption could help an attacker increase privileges. EPSS is low, it is not listed in CISA KEV, and no ransomware use is reported, so urgency is primarily driven by whether the driver is loaded on managed systems.

How an attack unfolds

An attacker first needs local access to a Linux system where the rtl8723bs driver is present and active, typically because the device uses Realtek RTL8723BS wireless hardware or the module is loaded. The attacker then causes a Wi-Fi connection request to be sent through the nl80211/cfg80211 path using a crafted WPA or WPA2 information element with a boundary-case length. The vulnerable driver accepts the malformed element because the parser’s length check wraps through an 8-bit comparison. The driver then copies 257 bytes into a 256-byte heap buffer, corrupting the adjacent field in kernel memory. Depending on kernel configuration, heap layout, and runtime protections, the result may be a kernel warning, crash, wireless-driver malfunction, or a primitive that could be combined with other techniques for privilege escalation.

How to fix it

Update to a Linux kernel build that includes the rtl8723bs bounds-check fix for rtw_cfg80211_set_wpa_ie(). No specific fixed package versions were provided in the input, so use the relevant Linux distribution or device-vendor security advisory and confirm the kernel changelog includes the rtl8723bs WPA/WPA2 IE length validation patch. If immediate patching is not possible and the hardware is not required, unload and blacklist the rtl8723bs driver. Restrict local users’ ability to manage Wi-Fi connections through policy controls where feasible, and ensure kernel hardening features such as KASLR, SMEP/SMAP, slab freelist hardening, and lockdown mode are enabled where supported.

How to confirm the fix worked

Confirm whether exposure exists by checking for the rtl8723bs module or built-in driver support using kernel configuration, module inventory, and hardware inventory. Validate remediation by confirming the installed kernel version or vendor package changelog contains the rtl8723bs fix adding explicit bounds checks before copying WPA/WPA2 information elements into supplicant_ie. On source-based systems, verify that rtw_cfg80211_set_wpa_ie() rejects any WPA/WPA2 IE whose total length exceeds the supplicant_ie buffer. After patching, confirm the driver still loads normally if required and that malformed or oversized WPA/WPA2 IE inputs are rejected without kernel warnings, crashes, or KASAN reports.

Typical attack path

1. Identify a Linux host where the rtl8723bs wireless driver is installed or loaded.
2. Obtain local code execution or access to an account allowed to initiate or influence Wi-Fi connection requests.
3. Submit a crafted nl80211 connect request containing a WPA or WPA2 information element with a length field that causes a 257-byte copy.
4. Trigger the vulnerable rtw_cfg80211_set_wpa_ie() copy path in kernel context.
5. Cause one-byte heap corruption adjacent to the supplicant_ie buffer.
6. Leverage the corruption to crash the kernel, disrupt wireless networking, or attempt further kernel exploitation if conditions are favorable.

How to detect it

There is no reliable network-only indicator because exploitation is triggered locally through the Linux wireless stack and may not emit detailed logs. Review kernel logs, persistent journal data, crash dumps, and EDR telemetry for signs of kernel memory corruption or crashes around Wi-Fi connection attempts. Prioritize systems where rtl8723bs is loaded and look for KASAN or general protection fault reports referencing rtw_cfg80211_set_wpa_ie(), rtw_parse_wpa_ie(), rtl8723bs, cfg80211, or nl80211. Correlate suspicious events with local processes that initiated wireless configuration changes, such as wpa_supplicant, NetworkManager, iw, custom wireless tooling, or unexpected user-launched processes interacting with netlink/nl80211. If eBPF, audit, or endpoint telemetry captures netlink activity, investigate unusual NL80211_CMD_CONNECT activity or repeated failed connection attempts immediately preceding a kernel warning, driver reset, panic, or reboot.

• rtl8723bs
• r8723bs
• rtw_cfg80211_set_wpa_ie
• rtw_parse_wpa_ie
• supplicant_ie
• nl80211
• NL80211_CMD_CONNECT
• cfg80211
• KASAN: slab-out-of-bounds
• BUG: KASAN
• general protection fault
• kernel panic
• wpa_supplicant
• NetworkManager

What your security team should do

• Prioritize patching systems where rtl8723bs is loaded, especially laptops, tablets, embedded devices, kiosks, and IoT-like Linux systems using Realtek RTL8723BS Wi-Fi hardware.
• Inventory endpoints and appliances for the rtl8723bs module or built-in driver support; deprioritize systems where the driver is absent and cannot be loaded.
• If patching is delayed, unload and blacklist rtl8723bs on systems that do not require that wireless hardware.
• Limit Wi-Fi management privileges to trusted users and services, reducing the chance that a low-privileged local process can trigger the vulnerable path.
• Monitor kernel logs for crashes, KASAN slab-out-of-bounds reports, or warnings involving rtw_cfg80211_set_wpa_ie, rtl8723bs, cfg80211, or nl80211 connect operations.
• Because public exploit maturity is reported as none and EPSS is low, treat this as a targeted local-risk issue rather than an internet-scale emergency, unless the affected driver is widely deployed in your fleet.