CVE-2026-64445staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: length = len - WLAN_HDR_A3_LEN - iv_len and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to size_t, causes crc32_le() to read far beyond the frame buffer. Add a minimum length check before accessing the IV field and calling the decryption path. When processing a seq=3 response, rtw_get_ie() stores the Challenge Text IE length in ie_len, but the subsequent memcmp() always reads 128 bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of exactly 128 bytes; reject any IE whose length field differs, matching the check already applied to OnAuthClient().
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before 665e1ecb68b4e8419604e70a33f02d1c8b0222c6; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before c9000c93078e5c0a5a651b077c0ec92a4bc7d580; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 1f6c9d255bdda41216b6e34c96aa2b1abee0bb84; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 3e44a7665f3abd320a80d9c64ee4a93317041b8b; 554c0a3abf216c991c5ebddcdb2c08689ecd290b builds before 64ec4192d9c10e96922245d4a6747304cc76b19d; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before d90b9f39f375c9826ef145605dfe97765d0ecb91; from 554c0a3abf216c991c5ebddcdb2c08689ecd290b before a1fc19d61f661d47204f095b593de507884849f7 | CNA record |
linux linux_kernel linux:linux_kernel | from 4.12 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 7.2; and 1 more ranges | NVD |
References
- https://git.kernel.org/stable/c/665e1ecb68b4e8419604e70a33f02d1c8b0222c6patch
- https://git.kernel.org/stable/c/87cccc2a767f17dcab71e3b9fe5ae29b5516c5cepatch
- https://git.kernel.org/stable/c/c9000c93078e5c0a5a651b077c0ec92a4bc7d580patch
- https://git.kernel.org/stable/c/1f6c9d255bdda41216b6e34c96aa2b1abee0bb84patch
- https://git.kernel.org/stable/c/3e44a7665f3abd320a80d9c64ee4a93317041b8bpatch
- https://git.kernel.org/stable/c/64ec4192d9c10e96922245d4a6747304cc76b19dpatch
- https://git.kernel.org/stable/c/d90b9f39f375c9826ef145605dfe97765d0ecb91patch
- https://git.kernel.org/stable/c/a1fc19d61f661d47204f095b593de507884849f7patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.