CyberSecBulletin
CVE-2026-64536NVD status: Undergoing Analysis

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64536 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7, d2055332297e24c63fffda943ef7a5eefc0a6019, 6f26cc55affd9d7f88ae2f5d12db4ecf9072c209 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7 or d2055332297e24c63fffda943ef7a5eefc0a6019 or 6f26cc55affd9d7f88ae2f5d12db4ecf9072c209 or 204b22c8df115370037248859bf0fa62db73a396, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, d2055332297e24c63fffda943ef7a5eefc0a6019; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 6f26cc55affd9d7f88ae2f5d12db4ecf9072c209; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 204b22c8df115370037248859bf0fa62db73a396; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 4380b3860d887a13555ff024a58dfc05b490dfd6; 554c0a3abf216c991c5ebddcdb2c08689ecd290b up to, but not including, 3bf39f711ff27c64be8680a8938bcc5001982e81; 4.12ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7, d2055332297e24c63fffda943ef7a5eefc0a6019, 6f26cc55affd9d7f88ae2f5d12db4ecf9072c209, 204b22c8df115370037248859bf0fa62db73a396, a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395, 4380b3860d887a13555ff024a58dfc05b490dfd6

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE->element_id and pIE->length are read without checking that i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the buffer causes an OOB read. - For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12, which requires pIE->length >= 16. For WLAN_EID_RSN it compares pIE->data + 8, requiring pIE->length >= 12. Neither requirement is checked. Add the missing IE header and payload bounds checks and guard each data access with an explicit pIE->length minimum, matching the pattern established in update_beacon_info().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.