CVE-2026-64441

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

Three IE/attribute parsing functions have missing bounds checks.

rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer

without verifying that the header bytes (tag + length) are within the

remaining buffer before reading them. Additionally, rtw_get_sec_ie()

compares the 4-byte WPA OUI at cnt+2 without checking that at least

6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at

cnt+6 without checking that at least 10 bytes remain.

rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at

entry, before verifying that wps_ielen is large enough to contain

the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside

the attribute loop, get_unaligned_be16() is called on attr_ptr and

attr_ptr+2 without checking that 4 bytes remain in the buffer.

Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie()

and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum

IE length requirement, add a wps_ielen < 6 early return in

rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.