CVE-2026-64444

CVE-2026-64444 is an out-of-bounds read in the rtl8723bs wireless driver, specifically in the OnAssocRsp() function that parses 802.11 Association Response frames. The vulnerability exists because the IE (Information Element) parsing loop advances through the buffer using stride lengths derived from data inside the buffer itself—specifically, each IE's length field determines how far the parser advances to reach the next element. A simple 'i < pkt_len' guard cannot catch this because the advancement stride depends on interior data, not buffer boundaries alone. The fix adds two necessary bounds checks: first, verifying that at least sizeof(*pIE) bytes remain before attempting to read the IE header, and second, confirming that the declared length in pIE->length does not extend past the available packet data. Both checks are correct, but they treat the symptom rather than the underlying architectural disease—the IE parsing idiom in this driver remains fundamentally fragile. What makes this CVE值得关注 is the staging classification. The rtl8723bs driver was demoted to staging because it was considered unstable and unmaintained, yet it ships in production kernels on embedded devices, IoT hardware, and SBCs where staging code runs by default. This driver processes frames from arbitrary access points within radio range—a high-risk trust boundary regardless of its staging label. The 'staging' designation created an implicit assumption that security scrutiny wasn't necessary, which is precisely the assumption this CVE exposes as false. The second-order implications matter. The fix addresses a case where pIE->length extends past pkt_len even when header bytes are in bounds—a failure mode that suggests the original code may have been silently processing truncated IE data in benign scenarios. Prior 'driver instability' events attributed to hardware quirks or RF interference in this driver could have been exploitation artifacts or trigger conditions that went unrecognized. This vulnerability is not an isolated incident. The same pattern—variable-stride IE parsing without pre-validation—has appeared in mac80211, ath9k, brcmfmac, rtw88, and other wireless drivers over the past fifteen years, each time receiving the same two-guard bandage applied locally. The kernel community has repeatedly chosen the cheap fix over a systematic redesign, likely because the cost of a safe IE iterator abstraction falls on maintainers while the exploitation risk is diffuse. Without a kernel-provided safe IE traversal API enforced in driver development standards, this vulnerability class will recur in different drivers. For defenders: identify devices running rtl8723bs or related Realtek staging wireless drivers, treat the staging classification as informational rather than a security boundary, and monitor for kernel wireless driver updates that include IE parsing bounds checks. The physical-layer threat model means exploitation leaves minimal forensic artifacts—no connection logs, no unusual processes, just potential heap memory disclosure to nearby attackers. If you have legacy devices exhibiting unexplained wireless driver instability, consider whether the root cause may predate this CVE.

Reviewed through automated stages and approved by a human before publication.