An out-of-bounds read occurs in the staging rtl8723bs wireless driver when processing the Wireless Multimedia (WMM) Information Element. The code accesses in_ie[i + 5] before verifying that i + 5 is less than the buffer length, enabling an attacker to read data beyond the intended bounds. This flaw can expose kernel memory contents but does not provide code execution or privilege escalation. The weakness is identified as classic out-of-bounds read (CWE-125 and CWE-805).

All Linux kernel systems that ship the staging rtl8723bs driver and contain a kernel version earlier than the commit 12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020 are affected. Distributions that include the vulnerable driver in their default kernel should consider this a risk until the upstream patch is applied.

Exploitation requires the delivery of a crafted WMM Information Element to a rtl8723bs device, which typically means an attacker must be within listening range of the wireless interface. Based on the description, it is inferred that the attack vector is a maliciously crafted wireless packet transmitted to the device. Because the vulnerability only allows memory reads, it does not grant arbitrary code execution or privilege escalation. The EPSS score is < 1%, the vulnerability is not listed in the CISA KEV catalog, and the CVSS score is 7.1, so the overall risk should be considered moderate to high in environments that handle sensitive data.