---
id: CVE-2025-71100
title: 'wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

  TID getting from ieee80211_get_tid() might be out of range of array size
  of sta_entry->tids[], so…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 <
    9765d6eb8298b07d499cdf9ef7c237d3540102d6
  - >-
    Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 <
    90a15ff324645aa806d81fa349497cd964861b66
  - >-
    Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 <
    dd39edb445f07400e748da967a07d5dca5c5f96e
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:05:46.666699Z'
published: '2026-01-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:46.511Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71100'
references:
  - url: 'https://git.kernel.org/stable/c/9765d6eb8298b07d499cdf9ef7c237d3540102d6'
  - url: 'https://git.kernel.org/stable/c/90a15ff324645aa806d81fa349497cd964861b66'
  - url: 'https://git.kernel.org/stable/c/dd39edb445f07400e748da967a07d5dca5c5f96e'
tags:
  - cve.org
epss: 0.00193
epssPercentile: 0.08355
ingestedAt: '2026-10-16T17:24:46.634Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

TID getting from ieee80211_get_tid() might be out of range of array size
of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise,
UBSAN warn:

 UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30
 index 10 is out of range for type 'rtl_tid_data [9]'

## Affected

- `Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < 9765d6eb8298b07d499cdf9ef7c237d3540102d6`
- `Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < 90a15ff324645aa806d81fa349497cd964861b66`
- `Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < dd39edb445f07400e748da967a07d5dca5c5f96e`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.