CVE-2026-64444: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each
iteration but only guards on i < pkt_len. When a malicious AP sends an
AssocResponse whose last IE has only one byte remaining in the frame
(the element_id byte lands at pkt_len-1), the loop reads pIE->length
from pframe[pkt_len], which is one byte past the allocated receive buffer.

Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond pkt_len, silently passing a
truncated IE to the handler functions.

Add two guards at the top of the loop body:
  1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
  2. Break if the IE's declared data extends past pkt_len.

The Linux kernel CVE team has assigned CVE-2026-64444 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 5.15.212 with commit 889ca6000ac7fa73457b041848fcb08e0d51b809
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.1.178 with commit 1a52a05471494546f955a58e8c170c0c796c52d5
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.6.145 with commit 0406d746574e875d8778552eb674fcfbf5330bfb
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.12.96 with commit 0970dd47726a57e52013594e9fbf667586eb3673
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.18.39 with commit 04f612dc03427e0b1ac80a2611b5ac0ba93ac446
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 7.1.4 with commit 7e7741c8315e4160aead00a60cdd6f81ab880717
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 7.2-rc3 with commit f9654207e92283e0acac5d64fe5f8835383b5a23

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64444
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/staging/rtl8723bs/core/rtw_mlme_ext.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/889ca6000ac7fa73457b041848fcb08e0d51b809
	https://git.kernel.org/stable/c/1a52a05471494546f955a58e8c170c0c796c52d5
	https://git.kernel.org/stable/c/0406d746574e875d8778552eb674fcfbf5330bfb
	https://git.kernel.org/stable/c/0970dd47726a57e52013594e9fbf667586eb3673
	https://git.kernel.org/stable/c/04f612dc03427e0b1ac80a2611b5ac0ba93ac446
	https://git.kernel.org/stable/c/7e7741c8315e4160aead00a60cdd6f81ab880717
	https://git.kernel.org/stable/c/f9654207e92283e0acac5d64fe5f8835383b5a23