The rtl8723bs driver in the Linux kernel staging tree performs out‑of‑bounds reads while processing Association Response information elements. The parsing loop moves through each IE by its declared length plus two bytes, but it only checks that the loop index is less than the packet length, not that the IE header itself is fully within bounds. An attacker can send a crafted Association Response whose last IE ends only one byte before the packet boundary, causing the driver to read an IE length field from memory beyond the allocated receive buffer. If an IE’s declared data length extends past the packet, the parser silently passes truncated data to subsequent handlers, potentially leading to a kernel crash or corruption of kernel memory.

Affected systems Linux kernel, rtl8723bs wireless driver, any pre‑fix kernel released from the staging tree; specific version range not documented.

Risk and exploitability The CVSS score is 8.1, EPSS <1 %, and the CVE is not listed in the CISA KEV catalog. Exploitation requires a nearby malicious access point to transmit crafted frames, and would result in a kernel crash or memory corruption. Although the current exploitation probability is low, the high severity and potential for instability warrant immediate remediation on affected systems.