CVE-2026-64440

CVE-2026-64440 (Linux kernel) : The vulnerability affects the rtl8723bs HT_capabilities handling in staging. HT_caps_handler() reads pIE->length bytes and writes into a fixed 26-byte HT_cap[]; since pIE->length is from an unvalidated 802.11 AssocResponse, an AP can set it to 255, causing up...

PT-2026-64661

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT caps handler HT caps handler iterates pIE-length bytes and writes into HT caps.u.HT cap, which is a fixed 26-byte array sizeof struct HT caps element. Because pIE-length is a raw u8 from an...