In the Linux kernel staging driver rtl8723bs, the function is_ap_in_tkip() loops over information elements (IEs) without validating that the buffer contains the full header and payload. The code reads pIE->element_id and pIE->length regardless of the current index, and for vendor‑specific and RSN IEs it accesses data fields that require a minimum length of 16 or 12 bytes respectively, without checking those bounds. Based on the description, it is inferred that this omission can allow an attacker to send malformed beacon or management frames that cause the driver to read past the end of the buffer, leading to kernel memory disclosure.

Any Linux system that builds the kernel with the rtl8723bs staging driver is affected, including laptops and embedded devices that use the 8723bs wireless adapter. No specific kernel version range is provided, so all kernels prior to the patch that contains the bounds checks are potentially vulnerable.

The EPSS score is < 1% and no public exploits are known, but the CVSS score of 8.1 categorizes it as a high‑severity out‑of‑bounds read that can lead to kernel memory disclosure. The flaw is not listed in CISA KEV, indicating no confirmed supply‑chain exploitation. Based on the description, it is inferred that the likely attack vector is sending malformed IEEE 802.11 frames over the air, requiring an attacker to be in physical or close proximity to the device. Although exploitation is complicated and would need adequate wireless framing knowledge, the potential for kernel data leakage and the high CVSS score make this a high‑risk issue that should be mitigated promptly.