CVE-2026-64446: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

supplicant_ie is a 256-byte array in struct security_priv. The WPA and
WPA2 IE copy paths use:

    memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);

where wpa_ielen is the raw IE length field (u8, 0-255). When a local user
supplies a connect request via nl80211 with a crafted WPA IE of length 255,
wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into
the adjacent last_mic_err_time field.

rtw_parse_wpa_ie() does not prevent this: its length consistency check
compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255
when wpa_ie_len = 257, so the check passes silently.

Add explicit bounds checks for both the WPA and WPA2 paths before the
memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the
supplicant_ie buffer.

The Linux kernel CVE team has assigned CVE-2026-64446 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 5.10.261 with commit a94a643a80a84ceb8139061c3d6bf988d75e45a5
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 5.15.212 with commit 2131621986c62c86109ce4d84cf73a73757eb8a6
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.1.178 with commit 6f20d7b0ee47c470734a69379b0fc6647c519603
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.6.145 with commit 5d7812360abf3143afcbf5efe4ef242448fa1f28
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.12.96 with commit 46f66c16a95191d9aca07a72ae6b1252a244e26c
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 6.18.39 with commit b9c4bf133c3c47e23baf4f5403b98a953bf58606
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 7.1.4 with commit 138cd190efd56ab36c9fdd8fef8749d06937f24b
	Issue introduced in 4.12 with commit 554c0a3abf216c991c5ebddcdb2c08689ecd290b and fixed in 7.2-rc3 with commit 5a752a616e756844388a1a45404db9fc29fec655

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64446
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5
	https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6
	https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603
	https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28
	https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c
	https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606
	https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b
	https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655