CVE-2026-64442: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Two IE parsing loops are missing the header bounds checks before they
dereference pIE->length:

 - issue_assocreq() walks pmlmeinfo->network.ies to build the
   association request. If the stored IE data ends with only an
   element_id byte and no length byte, pIE->length is read one byte
   past the end of the buffer.

 - join_cmd_hdl() walks pnetwork->ies during station join and has
   the same problem under the same conditions.

Both buffers are filled from AP beacon and probe-response frames, so a
malicious AP that sends a truncated final IE can trigger the issue.

Apply the two-guard pattern established in update_beacon_info():
  1. Break if fewer than sizeof(*pIE) bytes remain.
  2. Break if the IE's declared data extends past the buffer end.

The Linux kernel CVE team has assigned CVE-2026-64442 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 5.10.261 with commit bc881c9915c4468747d0ca5fd1abd7b313cfb0f4
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 5.15.212 with commit 605ebd94d0f469204f3c9f2f84acc71e43e2780f
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.1.178 with commit a830bdc82461353bf7b1f8a2ad2689bf5d2de444
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.6.145 with commit 4c21eec80cf502d9ea18e0b946246b2376452786
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.12.96 with commit ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.18.39 with commit c38d16b1ffac385c9e4b38447cd5c46af1114b58
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 7.1.4 with commit 402f13ec95945f34a210b28df1f8740d3d4a58c5
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 7.2-rc3 with commit ef61d628dfad38fead1fd2e08979ae9126d011d5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64442
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/staging/rtl8723bs/core/rtw_mlme_ext.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bc881c9915c4468747d0ca5fd1abd7b313cfb0f4
	https://git.kernel.org/stable/c/605ebd94d0f469204f3c9f2f84acc71e43e2780f
	https://git.kernel.org/stable/c/a830bdc82461353bf7b1f8a2ad2689bf5d2de444
	https://git.kernel.org/stable/c/4c21eec80cf502d9ea18e0b946246b2376452786
	https://git.kernel.org/stable/c/ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e
	https://git.kernel.org/stable/c/c38d16b1ffac385c9e4b38447cd5c46af1114b58
	https://git.kernel.org/stable/c/402f13ec95945f34a210b28df1f8740d3d4a58c5
	https://git.kernel.org/stable/c/ef61d628dfad38fead1fd2e08979ae9126d011d5