CVE-2026-64444

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop<br /> <br /> The IE parsing loop in OnAssocRsp() advances by (pIE-&gt;length + 2) each<br /> iteration but only guards on i length<br /> from pframe[pkt_len], which is one byte past the allocated receive buffer.<br /> <br /> Additionally, even when the header bytes are in bounds, pIE-&gt;length<br /> itself can extend the data window beyond pkt_len, silently passing a<br /> truncated IE to the handler functions.<br /> <br /> Add two guards at the top of the loop body:<br /> 1. Break if fewer than sizeof(*pIE) bytes remain (can&amp;#39;t read header).<br /> 2. Break if the IE&amp;#39;s declared data extends past pkt_len.