{"id":"CVE-2025-71234","title":"wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add\n\nThe driver does not set hw->sta_data_size, which causes mac80211 to\nallocate insufficient space for driver p…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 5d810ba377eddee95d30766d360a14efbb3d1872","Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 116f7bd8160c6b37d1c6939385abf90f6f6ed2f5","Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf","Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 86c946bcc00f6390ef65e9614ae60a9377e454f8","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:06:09.565107Z"},"published":"2026-02-18","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:09:47.950Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71234","references":[{"url":"https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872"},{"url":"https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5"},{"url":"https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf"},{"url":"https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8"}],"tags":["cve.org"],"epss":0.00187,"epssPercentile":0.07799,"ingestedAt":"2026-10-16T17:24:46.637Z","slug":"CVE-2025-71234","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add\n\nThe driver does not set hw->sta_data_size, which causes mac80211 to\nallocate insufficient space for driver private station data in\n__sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of\nstruct rtl8xxxu_sta_info through sta->drv_priv, this results in a\nslab-out-of-bounds write.\n\nKASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:\n\n  BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346\n  Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12\n\nSet hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during\nprobe, similar to how hw->vif_data_size is configured. This ensures\nmac80211 allocates sufficient space for the driver's per-station\nprivate data.\n\nTested on StarFive VisionFive 2 v1.2A board.\n\n## Affected\n\n- `Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 5d810ba377eddee95d30766d360a14efbb3d1872`\n- `Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 116f7bd8160c6b37d1c6939385abf90f6f6ed2f5`\n- `Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf`\n- `Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 86c946bcc00f6390ef65e9614ae60a9377e454f8`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}