SECUFOCUSNOW
Home›CVE index›CVE-2026-64445
Review reviewHigh

CVE-2026-64445

Linux

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: length = len - WLAN_HDR_A3_LEN - iv_len and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to...

CVSS
8.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: length = len - WLAN_HDR_A3_LEN - iv_len and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to...

Affected product and versions

Product
Linux
Affected versions
>= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 665e1ecb68b4e8419604e70a33f02d1c8b0222c6, >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce, >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < c9000c93078e5c0a5a651b077c0ec92a4bc7d580, >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 1f6c9d255bdda41216b6e34c96aa2b1abee0bb84, >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 3e44a7665f3abd320a80d9c64ee4a93317041b8b, >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < 64ec4192d9c10e96922245d4a6747304cc76b19d, >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < d90b9f39f375c9826ef145605dfe97765d0ecb91, >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b < a1fc19d61f661d47204f095b593de507884849f7, >= 4.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available
CVE-2026-64445 — Linux | SECUFOCUS NOW