In the Linux kernel, the rtl8723bs staging driver contains two loops that parse Information Elements during association request construction and station join handling. These loops omit bounds checks before dereferencing the pIE->length field. If a malicious Access Point sends a beacon or probe‑response frame with a truncated final IE, the driver reads past the end of the buffer, causing an out‑of‑bounds read in privileged kernel space. The read can expose kernel memory contents, potentially leaking sensitive information.

Systems running the Linux kernel with the rtl8723bs staging driver are affected. Kernels prior to the commits referenced in the provided Git URLs, where the rtl8723bs driver contains the vulnerable loops, are vulnerable.

The vulnerability has a CVSS score of 8.1, indicating high severity. Its EPSS score is less than 1%, and it is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. An attacker must control or manipulate a nearby wireless access point to send a malicious truncated IE; the victim device must be actively scanning or associating using the rtl8723bs hardware. Successful exploitation would result in leaking kernel memory contents, potentially leading to information disclosure.