The vulnerability arises from missing bounds checks in three parsing functions of the RTL8723BS wireless driver in the Linux kernel staging area. Under rtw_get_sec_ie() and rtw_get_wapi_ie(), the code accesses header bytes without ensuring the buffer limits are respected, and performs multi‑byte comparisons without verifying sufficient remaining data. In rtw_get_wps_attr() the code reads and dereferences pointers before validating the IEs length, and the inner attribute loop dereferences a 16‑bit value without a bounds check. These gaps allow an attacker to supply crafted information element frames that cause the driver to read beyond the end of the supplied buffer, potentially exposing kernel memory contents. This is a classic out‑of‑bounds read flaw mapped to CWE‑125 and could lead to information disclosure or subtle exploitation of additional vulnerabilities.

The flaw resides exclusively in the Linux kernel's rtl8723bs driver within the staging tree. Any kernel build that includes this driver prior to the listed commits is affected. The specific kernel version range is not listed in the available data, so any installation using the rtl8723bs driver should be checked against the commit identifiers referenced in the advisory.

The EPSS score is listed as less than 1 %, indicating a very low likelihood of widespread exploitation. The vulnerability is not currently listed in the CISA KEV catalog. An attacker would need to transmit malformed WLAN frames to a device using the rtl8723bs driver, which typically requires physical proximity or control of a Wi‑Fi access point, making the attack vector somewhat constrained. The overall risk is that compromised kernel memory could be read, potentially revealing sensitive data or aiding further attacks, but the exploitability remains low given the constrained vector and low EPSS.