CyberSecBulletin
CVE-2026-64445NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64445 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 665e1ecb68b4e8419604e70a33f02d1c8b0222c6, 87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce, c9000c93078e5c0a5a651b077c0ec92a4bc7d580 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.32% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 665e1ecb68b4e8419604e70a33f02d1c8b0222c6 or 87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce or c9000c93078e5c0a5a651b077c0ec92a4bc7d580 or 1f6c9d255bdda41216b6e34c96aa2b1abee0bb84, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 665e1ecb68b4e8419604e70a33f02d1c8b0222c6; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, c9000c93078e5c0a5a651b077c0ec92a4bc7d580; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 1f6c9d255bdda41216b6e34c96aa2b1abee0bb84; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 3e44a7665f3abd320a80d9c64ee4a93317041b8b; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 64ec4192d9c10e96922245d4a6747304cc76b19d; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, d90b9f39f375c9826ef145605dfe97765d0ecb91; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, a1fc19d61f661d47204f095b593de507884849f7; and 1 more ranges665e1ecb68b4e8419604e70a33f02d1c8b0222c6, 87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce, c9000c93078e5c0a5a651b077c0ec92a4bc7d580, 1f6c9d255bdda41216b6e34c96aa2b1abee0bb84, 3e44a7665f3abd320a80d9c64ee4a93317041b8b, 64ec4192d9c10e96922245d4a6747304cc76b19d
LinuxLinux Kernel4.12 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.96; 6.13 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.4; 7.25.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: length = len - WLAN_HDR_A3_LEN - iv_len and then passed as (length - 4) to crc32_le(). If len is less than WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative and, after the implicit cast to size_t, causes crc32_le() to read far beyond the frame buffer. Add a minimum length check before accessing the IV field and calling the decryption path. When processing a seq=3 response, rtw_get_ie() stores the Challenge Text IE length in ie_len, but the subsequent memcmp() always reads 128 bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of exactly 128 bytes; reject any IE whose length field differs, matching the check already applied to OnAuthClient().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.