The vulnerability is located in the rtl8723bs wireless driver’s rtw_get_ie() Information Element parser. It treats the length byte of each IE as trustworthy without guaranteeing that the IE body fits within the remaining frame buffer. When an attacker sends a malformed frame that advertises an IE length larger than the actual data, the parser will increment its pointer past the buffer end, resulting in out‑of‑bounds memory reads or, in certain patterns, an infinite loop. The out‑of‑bounds read could expose kernel memory contents, leading to information disclosure, and the loop could degrade system availability.

The flaw exists in the Linux kernel’s staging rtl8723bs driver. Any kernel build that contains an unpatched rtl8723bs driver before the commit that introduces the fix is vulnerable. No specific vendor or version list is supplied, so all Linux kernels using the unpatched driver are potentially affected.

The EPSS score is reported as less than 1%, indicating a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited. However, the likely attack vector is remote: an adversary could forge an 802.11 frame with a malicious Information Element and transmit it to a target device that loads the rtl8723bs driver. The out‑of‑bounds read may reveal kernel memory and could compromise confidentiality; the infinite‑loop scenario may affect availability.