The rtl8723bs wireless driver in the Linux kernel contains an uninitialized memory condition in the function rtw_BIP_verify(). The driver copies only six bytes into an eight‑byte u64 variable le_tmp64, leaving the upper two bytes undefined. When the variable is used later, the unpredictable content can affect calculations or state transitions in the driver, potentially causing kernel instability or incorrect behavior. The fix initializes the variable to zero before it is used, removing the undefined data.

Any Linux kernel that includes the staging rtl8723bs driver is affected, independent of version. The vulnerability is present in the code path until the commit that adds the initialization is incorporated. The affected product is the Linux kernel across all distributions shipping this driver, as identified by the CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:

The CVSS score of 7.1 signals moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. No explicit attack vector is documented; based on the description, exploitation would likely require local or privileged access to manipulate the driver or load it, making the risk to exposed hosts low under typical conditions.