CyberSecBulletin
CVE-2026-64442NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64442 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions bc881c9915c4468747d0ca5fd1abd7b313cfb0f4, 605ebd94d0f469204f3c9f2f84acc71e43e2780f, a830bdc82461353bf7b1f8a2ad2689bf5d2de444 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.29% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to bc881c9915c4468747d0ca5fd1abd7b313cfb0f4 or 605ebd94d0f469204f3c9f2f84acc71e43e2780f or a830bdc82461353bf7b1f8a2ad2689bf5d2de444 or 4c21eec80cf502d9ea18e0b946246b2376452786, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, bc881c9915c4468747d0ca5fd1abd7b313cfb0f4; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 605ebd94d0f469204f3c9f2f84acc71e43e2780f; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, a830bdc82461353bf7b1f8a2ad2689bf5d2de444; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 4c21eec80cf502d9ea18e0b946246b2376452786; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, c38d16b1ffac385c9e4b38447cd5c46af1114b58; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 402f13ec95945f34a210b28df1f8740d3d4a58c5; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, ef61d628dfad38fead1fd2e08979ae9126d011d5; and 1 more rangesbc881c9915c4468747d0ca5fd1abd7b313cfb0f4, 605ebd94d0f469204f3c9f2f84acc71e43e2780f, a830bdc82461353bf7b1f8a2ad2689bf5d2de444, 4c21eec80cf502d9ea18e0b946246b2376452786, ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e, c38d16b1ffac385c9e4b38447cd5c46af1114b58
LinuxLinux Kernel4.12 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.96; 6.13 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.4; 7.25.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and no length byte, pIE->length is read one byte past the end of the buffer. - join_cmd_hdl() walks pnetwork->ies during station join and has the same problem under the same conditions. Both buffers are filled from AP beacon and probe-response frames, so a malicious AP that sends a truncated final IE can trigger the issue. Apply the two-guard pattern established in update_beacon_info(): 1. Break if fewer than sizeof(*pIE) bytes remain. 2. Break if the IE's declared data extends past the buffer end.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.