CVE-2025-71234
Slab-Out-of-Bounds Write in Linux rtl8xxxu WiFi Driver
Publication date: 2026-02-18
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.19 (inc) to 6.19.1 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.11 (exc) |
| linux | linux_kernel | From 6.9 (inc) to 6.12.72 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's rtl8xxxu WiFi driver. The driver fails to set the hw->sta_data_size value, which causes the mac80211 subsystem to allocate insufficient memory for the driver's private station data. When the function rtl8xxxu_sta_add() accesses this private data, it writes beyond the allocated memory boundary, resulting in a slab-out-of-bounds write.
This issue was detected by the Kernel Address Sanitizer (KASAN) on a RISC-V platform using an RTL8192EU adapter, indicating a memory corruption bug due to improper memory allocation size.
The fix involves setting hw->sta_data_size to the correct size of the driver's private station info structure during the probe phase, ensuring mac80211 allocates enough space.
How can this vulnerability impact me? :
This vulnerability can lead to memory corruption in the Linux kernel's WiFi driver, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges.
Since the issue involves a slab-out-of-bounds write, it could be exploited to compromise the security and reliability of devices using the affected driver, especially those running on platforms like RISC-V with the RTL8192EU adapter.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by the driver not setting hw->sta_data_size, leading to insufficient memory allocation and a slab-out-of-bounds write.
To mitigate this vulnerability, ensure that the driver sets hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during the probe phase, similar to how hw->vif_data_size is configured.
Applying the patch or updating to a Linux kernel version that includes this fix will prevent the slab-out-of-bounds write.