CVE-2026-64445 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of affected Linux kernel versions should review and apply patches, verify system configurations, and monitor network traffic for suspicious activity. Affected operator roles include Linux kernel developers, Linux distribution vendors, and users of affected Linux kernel versions. The vulnerability-management impact includes reviewing and applying patches. The security-team impact

Why it matters

This vulnerability in the Linux kernel's rtl8723bs driver can potentially lead to denial of service or code execution. Linux kernel developers and maintainers, Linux distribution vendors, and users of affected Linux kernel versions should review and apply patches, verify system configurations, and monitor network traffic for suspicious activity.

• Denial of service due to potential out-of-bounds reads
• Potential code execution due to lack of input validation
• Verification of system configurations and updates required
• Monitoring of network traffic for suspicious activity recommended

Technical summary

The OnAuth() function in the rtl8723bs driver has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. This can cause a length underflow and out-of-bounds read. The vulnerability is related to improper input validation in the rtl8723bs driver. The affected product context includes Linux kernel versions that use the rtl8723bs driver. The defensive impact includes denial of service and potential code execution.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from the Linux kernel maintainers
• Verify system configurations and update vulnerable versions
• Monitor network traffic for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including a description of the issue and affected versions. The Linux kernel maintainers have provided patches to address this vulnerability. Users of affected Linux kernel versions should review and apply these patches. The vulnerability has been resolved in the Linux kernel. The source item provides additional information on the vulnerability. Defenders should verify system configurations and update vulnerable versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.