An unauthenticated attacker can exploit a buffer overflow in the Linux kernel rtl8723bs driver via crafted wireless frames, potentially leading to arbitrary code execution.

The vulnerability resides in the rtw_get_wps_attr function, which fails to validate the length of WPS attribute data read from wireless management frames. An unauthenticated, adjacent attacker can trigger a heap out-of-bounds read or a stack buffer overflow by sending a crafted WPS Information Element, causing the kernel to crash or potentially execute arbitrary code.

The exploitation of this vulnerability poses a severe risk to system integrity and availability. Given the CVSS score of 8.8, this flaw allows for high-impact compromise of the kernel, which could result in full system takeover or persistent denial of service. Because the attack vector is adjacent, it poses a direct threat to any infrastructure utilizing affected Wi-Fi hardware within range.

Immediate Action: Update the Linux kernel to the identified stable releases, specifically 5.15.221, 6.1.188, 6.6.157, or 6.12.110, depending on your distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected crashes associated with the rtl8723bs wireless driver during network scanning or association events.

Compensating Controls: If patching is not immediately feasible, consider disabling the affected wireless module if it is not required for core operations, as this eliminates the attack surface entirely.

Public Exploit Available: Unknown.

This vulnerability represents a significant risk due to its potential for kernel-level code execution triggered by unauthenticated, adjacent network traffic. Administrators should prioritize patching the Linux kernel on all systems utilizing the rtl8723bs driver. Ensure that security updates are applied as part of your standard maintenance cycle to mitigate the risk of memory corruption attacks.