The Linux kernel rtl8723bs staging driver contained a vulnerability in the rtw_get_wpa_ie() function where it performed out-of-bounds reads by accessing fixed offsets within a vendor-specific information element without verifying the element's length. Specifically, the function reads a 4-byte OUI+type and a 2-byte version word at fixed offsets assuming the element body is at least 6 bytes long. However, rtw_get_ie() only ensures the element fits within the buffer but does not guarantee a minimum length, allowing short elements (length 0 to 5) at the buffer's end to cause reads beyond the buffer boundary. This vulnerability was fixed by adding a length check requiring a minimum of 6 bytes before these reads.

The vulnerability allows out-of-bounds reads from kernel memory when processing certain vendor-specific information elements in management frames or WPA IE blobs. This could lead to information disclosure or kernel memory corruption depending on how the data is used. However, no known exploits in the wild have been reported. The impact is limited to the rtl8723bs staging driver in the Linux kernel.

A fix has been applied to the Linux kernel rtl8723bs staging driver to add the missing length check in rtw_get_wpa_ie(), preventing out-of-bounds reads. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly stated in the input data; check the vendor advisory or kernel changelogs for the exact fixed version.