The vulnerability arises in the staging rtl8723bs wireless driver in the Linux kernel. The function rtw_update_protection receives a pointer into an information element buffer with an offset, but the full ie_length is passed unchanged, causing a buffer over‑read. This flaw, identified as a buffer over‑read (CWE‑125), can allow a reader to access kernel memory that lies beyond the bounds of the intended buffer, potentially exposing sensitive data.

All Linux kernel installations that include the rtl8723bs driver are affected, including the 7.1 release candidate series and any distribution kernels that ship the default staging rtl8723bs code without the recent patch. The vulnerability applies to any kernel version containing the unpatched rtl8723bs driver code.

The CVSS score of 7.1 and an EPSS score of < 1% indicate a moderate severity and very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged interaction with the wireless interface—such as sending crafted IEs—to trigger the over‑read. While the flaw can expose kernel data, it does not directly provide code execution; however, it could lead to information disclosure or a denial of service if the read causes a fault.