The Linux kernel rtl8723bs staging driver contained a vulnerability in the rtw_get_ie() Information Element parser. The parser trusted the IE length byte without verifying that the IE data fits within the remaining frame buffer, allowing a malformed frame to cause out-of-bounds reads or infinite loops. The issue was fixed by adding validation to ensure the sum of the current offset, IE header, and IE length does not exceed the buffer limit before processing or advancing to the next IE. This prevents memory safety violations and ensures safe termination of the parser on malformed input.

An attacker could send a malformed frame with an invalid IE length, causing the kernel driver to read beyond the buffer boundary or enter an infinite loop. This could lead to information disclosure, denial of service, or potentially code execution depending on the context. The CVSS 3.1 vector indicates high impact on confidentiality, integrity, and availability.

A fix has been implemented that validates IE lengths before parsing, preventing out-of-bounds reads and infinite loops. Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed in this data; check the Linux kernel vendor advisory for current remediation guidance.