In the Linux kernel, the rtl8723bs wireless driver performed insecure parsing of Information Element data from network frames. The function rtw_get_wps_ie() read header and payload bytes without ensuring they lay within the remaining buffer. This lack of bounds checking allowed an attacker to craft frames that cause the driver to read beyond allocated memory, potentially exposing kernel memory contents or causing a crash. The flaw is an out‑of‑bounds read (CWE‑125) and does not directly provide remote code execution but could lead to information disclosure or denial of service.

All kernel builds that include the staging rtl8723bs driver before the commit that introduces the bounds checks are affected. The adapter is used in devices relying on Realtek 8723BS wireless hardware. The advisory does not list specific kernel versions, but the listed commit references point to the vulnerable code path present in earlier kernel releases.

No publicly documented exploit exists and the EPSS score of < 1% indicates a low exploitation probability. The vulnerability is not a CISA KEV item. An attacker must transmit a malicious wireless frame to a device that uses the rtl8723bs driver, which is a local or remote (wireless) attack vector. While the flaw can leak memory or crash the kernel, it does not grant the attacker control or persistence, resulting in a moderate overall risk. The CVSS score is 5.9, indicating moderate severity.