The Linux kernel’s rtl8723bs staging driver contains two flaws that can be triggered during shared-key authentication. In rtw_wep_decrypt() the driver calculates a length from the received frame and, after an implicit cast to size_t, passes a negative value to crc32_le(), leading to an out-of-bounds read of the packet buffer. A second flaw occurs when processing a seq=3 response; the code always compares 128 bytes of the Challenge Text IE regardless of its declared length, causing an additional out-of-bounds read. Based on the description, it is inferred that a malicious 802.11 frame can trigger these out-of-bounds reads, potentially exposing kernel memory and causing a crash, but not providing arbitrary code execution.

Linux kernel installations that include the rtl8723bs driver in the staging tree without the recent patch are affected. This includes all distributions that ship the module in the kernel, as well as custom kernels that incorporate the rtl8723bs module without the fix.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is expected to be uncommon, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need the ability to inject crafted 802.11 frames toward the victim’s wireless interface, such as a rogue access point or a device capable of forging Wi‑Fi packets. Therefore, the likely attack vector is a malicious wireless device that transmits malformed IEEE 802.11 frames. Under these constrained conditions, the out‑of‑bounds read can lead to information disclosure or a local denial of service, but the attack complexity is high and the impact is limited to the victim’s host.