The rtl8723bs staging driver contains a flaw where the function that extracts the WPA information element reads a version field and an OUI+type from a vendor‑specific IE without first verifying that the IE body is at least 6 bytes long. If the IE length byte is between 0 and 5, these reads access memory past the end of the IE and past the end of the allocated buffer, resulting in an out‑of‑bounds read that could expose sensitive kernel data. The affected code path is exercised when processing received management frames or when a user calls rtw_cfg80211_set_wpa_ie(), which copies the IE blob verbatim. No known authentication or privilege checks are involved, so the read can be triggered simply by a crafted frame.

Any Linux system that builds the kernel with the rtl8723bs driver in the staging tree is affected. This includes standard distributions that ship the driver as part of the kernel and any custom builds that incorporate the staging driver. The vulnerability is tied to the hardware identifier 221 (EID 221) and applies to all instances of the rtl8723bs chipset handled by the driver.

The vulnerability can be exploited by sending a malformed vendor‑specific IE that is too short to the rtl8723bs device. Because the driver performs no bounds check on the IE body, the kernel will read past the allocated buffer, allowing an attacker to tail the bytes read by the kernel. This read can be triggered by remote traffic, so the attack is possible without privileged local access. The exploitation path requires the target to have a working rtl8723bs driver, and the attacker must have sufficient wireless transmission capability to reach the device.