The Linux kernel rtl8723bs staging driver contained a heap buffer overflow vulnerability in the rtw_cfg80211_set_wpa_ie() function. The supplicant_ie buffer is 256 bytes, but the code copied wpa_ielen + 2 bytes without proper bounds checking, where wpa_ielen is a length field up to 255. A crafted WPA IE of length 255 causes the memcpy to copy 257 bytes, overflowing the buffer by one byte into adjacent memory. The existing length check in rtw_parse_wpa_ie() was insufficient due to incorrect comparison logic. The vulnerability was resolved by adding explicit bounds checks before the memcpy to reject oversized IEs.

The vulnerability allows a local user to trigger a heap buffer overflow by supplying a crafted WPA IE in a connect request via nl80211. This overflow could corrupt adjacent memory, potentially leading to undefined behavior such as crashes or memory corruption within the kernel's wireless driver. No known exploits in the wild have been reported. The impact is limited to local users with the ability to send crafted connect requests to the affected driver.

A fix has been implemented that adds explicit bounds checks to prevent the heap buffer overflow by rejecting WPA IE inputs exceeding the buffer size. Since this is a Linux kernel vulnerability, users should apply the official kernel updates or patches that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the vendor or Linux kernel advisory for the current remediation status and apply updates accordingly.