CVE-2026-64441

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()<br /> <br /> Three IE/attribute parsing functions have missing bounds checks.<br /> <br /> rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer<br /> without verifying that the header bytes (tag + length) are within the<br /> remaining buffer before reading them. Additionally, rtw_get_sec_ie()<br /> compares the 4-byte WPA OUI at cnt+2 without checking that at least<br /> 6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at<br /> cnt+6 without checking that at least 10 bytes remain.<br /> <br /> rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at<br /> entry, before verifying that wps_ielen is large enough to contain<br /> the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside<br /> the attribute loop, get_unaligned_be16() is called on attr_ptr and<br /> attr_ptr+2 without checking that 4 bytes remain in the buffer.<br /> <br /> Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie()<br /> and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum<br /> IE length requirement, add a wps_ielen