CyberSecBulletin
CVE-2026-64441NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64441 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions efa27d487abcdec79669a60a6d94d5d6eceb7c1d, 2ea1ce30ead61589214240e8d33d96310fd613e5, b27ecba3196f6c14e3809595ebd69c0c2392512a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to efa27d487abcdec79669a60a6d94d5d6eceb7c1d or 2ea1ce30ead61589214240e8d33d96310fd613e5 or b27ecba3196f6c14e3809595ebd69c0c2392512a or 6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.212 or 6.1.178 or 6.6.145 or 6.12.97, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, efa27d487abcdec79669a60a6d94d5d6eceb7c1d; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 2ea1ce30ead61589214240e8d33d96310fd613e5; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, b27ecba3196f6c14e3809595ebd69c0c2392512a; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 4b51ee8a40fe47864197d73cc02b191de7a6b072; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 729c4e72563bda0f1725db1db9ea08df06f41d9b; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344; 4.12efa27d487abcdec79669a60a6d94d5d6eceb7c1d, 2ea1ce30ead61589214240e8d33d96310fd613e5, b27ecba3196f6c14e3809595ebd69c0c2392512a, 6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c, 4b51ee8a40fe47864197d73cc02b191de7a6b072, 729c4e72563bda0f1725db1db9ea08df06f41d9b
LinuxLinux Kernel4.12 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.97; 6.13 up to, but not including, 6.18.40; 6.19 up to, but not including, 7.1.4; 7.25.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Three IE/attribute parsing functions have missing bounds checks. rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer without verifying that the header bytes (tag + length) are within the remaining buffer before reading them. Additionally, rtw_get_sec_ie() compares the 4-byte WPA OUI at cnt+2 without checking that at least 6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at cnt+6 without checking that at least 10 bytes remain. rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at entry, before verifying that wps_ielen is large enough to contain the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside the attribute loop, get_unaligned_be16() is called on attr_ptr and attr_ptr+2 without checking that 4 bytes remain in the buffer. Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie() and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum IE length requirement, add a wps_ielen < 6 early return in rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.