CVE-2026-64515

In the Linux kernel’s wifi/mac80211 stack, CVE-2026-64515 describes a defect in MLE (Multi-Link Element) defragmentation. When reconf or EPCS MLE is present in a non-transmitted profile, the defragmentation routine is invoked with a pointer to the defragmented copy but the original elements, caus...

CVE-2026-64515 wifi: mac80211: fix MLE defragmentation

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...

CVE-2026-64446 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtwcfg80211setwpaie supplicantie is a 256-byte array in struct securitypriv. The WPA and WPA2 IE copy paths use: memcpypadapter-securitypriv.supplicantie, &pwpa0, wpaielen + 2; wher...

CVE-2026-64446

CVE-2026-64446 is a heap buffer overflow in the Linux kernel's rtl8723bs staging driver . In rtw_cfg80211_set_wpa_ie(), the supplicant_ie array is 256 bytes, but the memcpy for WPA/WPA2 IE copies wpa_ielen + 2 bytes where wpa_ielen is an unsigned 8-bit value (max 255). A local user supplying a cr...

CVE-2026-64446

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtwcfg80211setwpaie supplicantie is a 256-byte array in struct securitypriv. The WPA and WPA2 IE copy paths use: memcpypadapter-securitypriv.supplicantie, 0, wpaielen + 2; where...

CVE-2026-64443 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

CVE-2026-64443

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

CVE-2026-64444

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp IE loop The IE parsing loop in OnAssocRsp advances by pIE-length + 2 each iteration but only guards on i length from pframepktlen, which is one byte past the allocated receive buffer...

CVE-2026-64442

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

CVE-2026-64442

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

CVE-2026-64441

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

CVE-2026-64441

The CVE-2026-64441 fix applies to the Linux kernel staging rtl8723bs code and addresses out-of-bounds reads in three IE/attribute parsers: rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr(). The patch adds cnt+2 bounds checks before loop bodies in rtw_get_sec_ie() and rtw_get_wapi_ie(), ...

CVE-2026-64441 staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

EUVD-2026-48785

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

CVE-2026-64441

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

EUVD-2026-48896

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

PT-2026-64663

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Out-of-bounds reads occur in the rtl8723bs staging driver due to missing header bounds checks in two Information Element IE parsing loops. Specifically, the functions issue assocreq and...

PT-2026-64667

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap buffer overflow exists in the rtw cfg80211 set wpa ie function within the rtl8723bs staging driver. The issue occurs because the supplicant ie array in struct security priv is 256...

Linux Distros Unpatched Vulnerability : CVE-2026-64442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference...

Linux Distros Unpatched Vulnerability : CVE-2026-64441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie a...