The vulnerability is a NULL pointer dereference in the rtl8723bs driver for the Linux kernel. It occurs when the kernel fails to allocate a buffer with kzalloc_flex and proceeds to dereference the returned pointer unconditionally. This can cause the kernel to crash, resulting in a denial of service on the affected system. The weakness falls under CWE‑476 and CWE‑690.

Any Linux system that includes the rtl8723bs wireless driver prior to the application of the fix is affected. This encompasses most distributions that ship the driver in the staging tree of the kernel. No specific kernel version list is provided, but any kernel release before the commit that guards the allocation is vulnerable.

The CVSS score is not disclosed, and the EPSS score is not available, so the precise quantitative risk is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local kernel privileges to trigger the crash, so while it cannot lead to remote code execution, it can be deniable by an attacker with physical or local access to the system. The risk is moderate, mainly due to potential service disruption.