The Linux kernel rtl8723bs staging driver contained a vulnerability (CVE-2026-64536) where the is_ap_in_tkip() function iterated over WLAN Information Elements without verifying sufficient remaining bytes before dereferencing IE headers and payloads. Specifically, pIE->element_id and pIE->length were accessed without confirming that the current index plus the IE header size did not exceed the buffer length, allowing OOB reads if a truncated IE was at the buffer's end. Additionally, for WLAN_EID_VENDOR_SPECIFIC and WLAN_EID_RSN elements, required minimum payload lengths were not checked before accessing offsets within the data. The fix involved adding explicit bounds checks on IE headers and payload lengths, following the pattern used in update_beacon_info(), to prevent out-of-bounds memory access.

Successful exploitation of this vulnerability could lead to out-of-bounds reads in kernel memory, potentially causing denial of service (kernel crash) or information disclosure. The CVSS vector indicates the attack requires adjacent network access, no privileges, and no user interaction, with high impact on confidentiality and availability but no integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposure to untrusted WLAN frames that could trigger the vulnerable code. Monitor vendor channels for updates and apply patches promptly once released.