Advisory [CVE-2026-64443] fix OOB read in update_beacon_info IE loop

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i length from one byte past the allocated receive buffer.

Additionally, even when the header bytes are in bounds, pIE->length itself can extend the data window beyond len, passing a truncated IE to the handler functions. Add two guards at the top of the loop body: 1.

Break if fewer than sizeof(*pIE) bytes remain (can't read header). 2.

Break if the IE's declared data extends past len. Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length for consistency with the sizeof(*pIE) guards added above.

A remote attacker could exploit an out-of-bounds read vulnerability in the `update_beacon_info()` function by sending a specially crafted wireless Beacon frame containing a malformed Information Element (IE). This could lead to the disclosure of sensitive information or cause a denial of-service (DoS) on the affected system.

Red Hat severity: not rated. Weakness: CWE-125.

Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.