GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-71234 (GCVE-0-2025-71234)

Vulnerability from cvelistv5 – Published: 2026-02-18 14:53 – Updated: 2026-08-05 12:12
VLAI
Title
wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add The driver does not set hw->sta_data_size, which causes mac80211 to allocate insufficient space for driver private station data in __sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of struct rtl8xxxu_sta_info through sta->drv_priv, this results in a slab-out-of-bounds write. KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter: BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346 Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12 Set hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during probe, similar to how hw->vif_data_size is configured. This ensures mac80211 allocates sufficient space for the driver's per-station private data. Tested on StarFive VisionFive 2 v1.2A board.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: eef55f1545c92c7181d5083453dee1296298ad3e , < 5d810ba377eddee95d30766d360a14efbb3d1872 (git)
Affected: eef55f1545c92c7181d5083453dee1296298ad3e , < 116f7bd8160c6b37d1c6939385abf90f6f6ed2f5 (git)
Affected: eef55f1545c92c7181d5083453dee1296298ad3e , < 9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf (git)
Affected: eef55f1545c92c7181d5083453dee1296298ad3e , < 86c946bcc00f6390ef65e9614ae60a9377e454f8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.72 , ≤ 6.12.* (semver)
Unaffected: 6.18.11 , ≤ 6.18.* (semver)
Unaffected: 6.19.1 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl8xxxu/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5d810ba377eddee95d30766d360a14efbb3d1872",
              "status": "affected",
              "version": "eef55f1545c92c7181d5083453dee1296298ad3e",
              "versionType": "git"
            },
            {
              "lessThan": "116f7bd8160c6b37d1c6939385abf90f6f6ed2f5",
              "status": "affected",
              "version": "eef55f1545c92c7181d5083453dee1296298ad3e",
              "versionType": "git"
            },
            {
              "lessThan": "9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf",
              "status": "affected",
              "version": "eef55f1545c92c7181d5083453dee1296298ad3e",
              "versionType": "git"
            },
            {
              "lessThan": "86c946bcc00f6390ef65e9614ae60a9377e454f8",
              "status": "affected",
              "version": "eef55f1545c92c7181d5083453dee1296298ad3e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl8xxxu/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.72",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add\n\nThe driver does not set hw-\u003esta_data_size, which causes mac80211 to\nallocate insufficient space for driver private station data in\n__sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of\nstruct rtl8xxxu_sta_info through sta-\u003edrv_priv, this results in a\nslab-out-of-bounds write.\n\nKASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:\n\n  BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346\n  Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12\n\nSet hw-\u003esta_data_size to sizeof(struct rtl8xxxu_sta_info) during\nprobe, similar to how hw-\u003evif_data_size is configured. This ensures\nmac80211 allocates sufficient space for the driver\u0027s per-station\nprivate data.\n\nTested on StarFive VisionFive 2 v1.2A board."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A nearby radio peer can trigger the vulnerable station transition through ordinary Wi-Fi authentication and association management frames sent to an rtl8xxxu-backed AP. Radio proximity makes this Adjacent rather than Network.\nAC:L - The out-of-bounds writes occur deterministically whenever a station transitions from authenticated to associated; no race or condition outside the attacker\u2019s control is required. Associations can be repeated using attacker-controlled MAC addresses.\nPR:N - The AP transitions a peer to associated before controlled-port authorization and WPA credential verification ([hostapd source](https://android.googlesource.com/platform/external/wpa_suppl icant_8/%2B/2907c8a9c2e7485086db5b9dc02fe96c5c76ffa8/src/ap/ieee802_ 11.c)). A nearby unauthenticated peer therefore needs no privileges.\nUI:N - An already-running AP processes authentication and association attempts automatically. No victim user must approve or open anything.\nS:U - Exploitation compromises the kernel and resources governed by that same host security authority. It does not inherently cross a VM, IOMMU, or comparable security boundary.\nC:H - The repeated heap out-of-bounds corruption can potentially be developed into kernel code execution and arbitrary memory disclosure. Applying the required higher-severity choice makes confidentiality High.\nI:H - The driver performs a confirmed eight-byte slab out-of-bounds write plus additional out-of-bounds byte writes, with subsequent RSSI-driven updates. This memory corruption can potentially corrupt heap state and hijack kernel control flow.\nA:H - The confirmed slab violation can produce an oops or panic, particularly with memory-safety instrumentation, and association attempts can be repeated remotely. Kernel memory corruption therefore has High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:34.848Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872"
        },
        {
          "url": "https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8"
        }
      ],
      "title": "wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71234",
    "datePublished": "2026-02-18T14:53:18.893Z",
    "dateReserved": "2026-02-18T14:25:13.845Z",
    "dateUpdated": "2026-08-05T12:12:34.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71234",
      "date": "2026-09-16",
      "epss": "0.00169",
      "percentile": "0.06611"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T04:29:07.000Z",
      "cve": "CVE-2025-71234",
      "id": "msrc_CVE-2025-71234",
      "initial_release_date": "2026-02-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-71234.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71234\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-18T16:22:30.190\",\"lastModified\":\"2026-07-30T06:24:56.307\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add\\n\\nThe driver does not set hw-\u003esta_data_size, which causes mac80211 to\\nallocate insufficient space for driver private station data in\\n__sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of\\nstruct rtl8xxxu_sta_info through sta-\u003edrv_priv, this results in a\\nslab-out-of-bounds write.\\n\\nKASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:\\n\\n  BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346\\n  Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12\\n\\nSet hw-\u003esta_data_size to sizeof(struct rtl8xxxu_sta_info) during\\nprobe, similar to how hw-\u003evif_data_size is configured. This ensures\\nmac80211 allocates sufficient space for the driver\u0027s per-station\\nprivate data.\\n\\nTested on StarFive VisionFive 2 v1.2A board.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nwifi: rtl8xxxu: correcci\u00f3n de slab-out-of-bounds en rtl8xxxu_sta_add\\n\\nEl controlador no establece hw-\u0026gt;sta_data_size, lo que provoca que mac80211 asigne espacio insuficiente para los datos privados de estaci\u00f3n del controlador en __sta_info_alloc(). Cuando rtl8xxxu_sta_add() accede a miembros de struct rtl8xxxu_sta_info a trav\u00e9s de sta-\u0026gt;drv_priv, esto resulta en una escritura slab-out-of-bounds.\\n\\nInforme KASAN en RISC-V (VisionFive 2) con adaptador RTL8192EU:\\n\\n  BUG: KASAN: slab-out-of-bounds en rtl8xxxu_sta_add+0x31c/0x346\\n  Escritura de tama\u00f1o 8 en la direcci\u00f3n ffffffd6d3e9ae88 por la tarea kworker/u16:0/12\\n\\nEstablecer hw-\u0026gt;sta_data_size a sizeof(struct rtl8xxxu_sta_info) durante probe, de forma similar a c\u00f3mo se configura hw-\u0026gt;vif_data_size. Esto asegura que mac80211 asigne espacio suficiente para los datos privados por estaci\u00f3n del controlador.\\n\\nProbado en placa StarFive VisionFive 2 v1.2A.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtl8xxxu/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eef55f1545c92c7181d5083453dee1296298ad3e\",\"lessThan\":\"5d810ba377eddee95d30766d360a14efbb3d1872\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eef55f1545c92c7181d5083453dee1296298ad3e\",\"lessThan\":\"116f7bd8160c6b37d1c6939385abf90f6f6ed2f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eef55f1545c92c7181d5083453dee1296298ad3e\",\"lessThan\":\"9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eef55f1545c92c7181d5083453dee1296298ad3e\",\"lessThan\":\"86c946bcc00f6390ef65e9614ae60a9377e454f8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/realtek/rtl8xxxu/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.72\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.11\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.1\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.12.72\",\"matchCriteriaId\":\"BC3EBF44-550D-4B5C-9CD4-93342B1A49F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.11\",\"matchCriteriaId\":\"7099A9EC-3D54-4424-BF01-7224EF88C79C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.1\",\"matchCriteriaId\":\"EE543C0D-A06B-414F-A403-CB1E088F261E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:32:24+00:00",
      "cve": "CVE-2025-71234",
      "id": "CVE-2025-71234",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71234.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-28T16:47:25Z",
      "cve": "CVE-2025-71234",
      "id": "CVE-2025-71234",
      "initial_release_date": "2026-02-19T00:28:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "320",
      "product_status:recommended": "284",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71234",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71234.json",
      "version": "28"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.