{"id":"AZL-93959","summary":"CVE-2026-64536 affecting package kernel for versions less than 6.6.145.2-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop\n\nThe loop in is_ap_in_tkip() iterates over IEs without verifying that\nenough bytes remain before dereferencing the IE header or its payload:\n\n- pIE-\u003eelement_id and pIE-\u003elength are read without checking that\n  i + sizeof(*pIE) \u003c= ie_length, so a truncated IE at the end of the\n  buffer causes an OOB read.\n\n- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE-\u003edata + 12,\n  which requires pIE-\u003elength \u003e= 16.  For WLAN_EID_RSN it compares\n  pIE-\u003edata + 8, requiring pIE-\u003elength \u003e= 12.  Neither requirement\n  is checked.\n\nAdd the missing IE header and payload bounds checks and guard each\ndata access with an explicit pIE-\u003elength minimum, matching the\npattern established in update_beacon_info().","modified":"2026-08-28T17:47:41.142861962Z","published":"2026-07-27T08:16:22Z","upstream":["CVE-2026-64536"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64536"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.145.2-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-93959.json"}}],"schema_version":"1.9.0"}