Strix
57.4K

CVE-2026-74649

Unknown

Last modified

CVE-2026-74649 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication.

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory. The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 39ae1033071001af9bb4573ebdbb43bbbe88f749; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 4d018e7d7d908bdfcb5ecfa922b1d5cb9ddb3722; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 4ba402fd47009d20e51dbfc934abb562098ea35b; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 87c2f073d2aaea041d531b8e579c47570b54b3b7; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < a28a4b0592e4a37ea471bc0d308513a93133ce7e; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 6235b5156b48ed5d1ce3410d8f0b2fd67d30d944; >= 554c0a3abf216c991c5ebddcdb2c08689ecd290b, < 2c56ef658ac8c6bca36bc5574715e8f717207c6c
LinuxLinux4.12

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-74649?
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer. In OnAuthClient() the length from rtw_get_ie() - up to 255 - is used to perform memcpy() into the 128-byte pmlmeinfo->chg_txt, so a malicious AP sending a malformed WLAN_EID_CHALLENGE element can overflow/underfill chg_txt by up to 127 bytes. It is reachable over the air, before association, during shared-key authentication. In the case of an overflow, the driver can write out of bounds. In the case of an underfill, the driver can echo stale buffer memory. The challenge text is defined to be exactly 128 octets, which is already provided as the WLAN_AUTH_CHALLENGE_LEN define; require the element to be exactly that length before use.
How severe is CVE-2026-74649?
Severity scoring for CVE-2026-74649 is pending analysis.
How do I fix CVE-2026-74649?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-74649?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST