Skip to content
Heist/ feed
High

staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: length = len - WLAN_HDR_A3_LEN - iv_len and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to size_t, causes crc32_le() to read far beyond the frame buffer. Add a minimum length check before accessing the IV field and calling the decryption path. When processing a seq=3 response, rtw_get_ie() stores the Challenge Text IE length in ie_len, but the subsequent memcmp() always reads 128 bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of exactly 128 bytes; reject any IE whose length field differs, matching the check already applied to OnAuthClient().

Announced Source revision 1
Original source ↗

CVE-2026-64445

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-64445

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
        "lessThan": "665e1ecb68b4e8419604e70a33f02d1c8b0222c6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
        "lessThan": "87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
        "lessThan": "c9000c93078e5c0a5a651b077c0ec92a4bc7d580",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
        "lessThan": "1f6c9d255bdda41216b6e34c96aa2b1abee0bb84",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
        "lessThan": "3e44a7665f3abd320a80d9c64ee4a93317041b8b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
        "lessThan": "64ec4192d9c10e96922245d4a6747304cc76b19d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
        "lessThan": "d90b9f39f375c9826ef145605dfe97765d0ecb91",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
        "lessThan": "a1fc19d61f661d47204f095b593de507884849f7",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.12"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.12",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.261",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.212",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.178",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.145",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.96",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.39",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.4",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-64445

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#41050 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement