staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-64445
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-25 10:17:29 UTC
Updated2026-07-27 05:16:51 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: length = len - WLAN_HDR_A3_LEN - iv_len and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to size_t, causes crc32_le() to read far beyond the frame buffer. Add a minimum length check before accessing the IV field and calling the decryption path. When processing a seq=3 response, rtw_get_ie() stores the Challenge Text IE length in ie_len, but the subsequent memcmp() always reads 128 bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of exactly 128 bytes; reject any IE whose length field differs, matching the check already applied to OnAuthClient().

Risk And Classification

Primary CVSS: v3.1 8.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.003160000 probability, percentile 0.239940000 (date 2026-07-29)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED8.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 665e1ecb68b4e8419604e70a33f02d1c8b0222c6 git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b c9000c93078e5c0a5a651b077c0ec92a4bc7d580 git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 1f6c9d255bdda41216b6e34c96aa2b1abee0bb84 git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 3e44a7665f3abd320a80d9c64ee4a93317041b8b git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b 64ec4192d9c10e96922245d4a6747304cc76b19d git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b d90b9f39f375c9826ef145605dfe97765d0ecb91 git Not specified
CNA Linux Linux affected 554c0a3abf216c991c5ebddcdb2c08689ecd290b a1fc19d61f661d47204f095b593de507884849f7 git Not specified
CNA Linux Linux affected 4.12 Not specified
CNA Linux Linux unaffected 4.12 semver Not specified
CNA Linux Linux unaffected 5.10.261 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.96 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.39 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.4 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d90b9f39f375c9826ef145605dfe97765d0ecb91 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1f6c9d255bdda41216b6e34c96aa2b1abee0bb84 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/64ec4192d9c10e96922245d4a6747304cc76b19d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3e44a7665f3abd320a80d9c64ee4a93317041b8b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/665e1ecb68b4e8419604e70a33f02d1c8b0222c6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c9000c93078e5c0a5a651b077c0ec92a4bc7d580 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a1fc19d61f661d47204f095b593de507884849f7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report