The Linux kernel staging driver for the Realtek RTL8723BS wireless chipset allocates the HalData structure with vzalloc but frees it with kfree in an error path of rtw_sdio_if1_init(). Using kfree on vmalloc-backed memory corrupts the kernel heap, which can lead to arbitrary code execution or a kernel panic, thereby compromising system availability and integrity.

The flaw resides in the rtl8723bs driver that ships with the mainline Linux kernel. Any kernel build that includes this staging driver and enables RTL8723BS SDIO hardware is potentially vulnerable; the issue existed across any release prior to the applied patch.

No CVSS or EPSS scores are listed and the vulnerability is not in CISA’s KEV catalog, suggesting a lower probability of exploitation in the wild. Nevertheless, the flaw can be triggered in an environment where an attacker can cause the driver’s initialization to fail, resulting in memory corruption. The vendor fix replaces the incorrect kfree call with rtw_hal_data_deinit() that uses vfree, restoring proper memory management.