---
id: CVE-2025-71234
title: 'wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add

  The driver does not set hw->sta_data_size, which causes mac80211 to
  allocate insufficient space for driver p…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eef55f1545c92c7181d5083453dee1296298ad3e <
    5d810ba377eddee95d30766d360a14efbb3d1872
  - >-
    Linux >= eef55f1545c92c7181d5083453dee1296298ad3e <
    116f7bd8160c6b37d1c6939385abf90f6f6ed2f5
  - >-
    Linux >= eef55f1545c92c7181d5083453dee1296298ad3e <
    9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf
  - >-
    Linux >= eef55f1545c92c7181d5083453dee1296298ad3e <
    86c946bcc00f6390ef65e9614ae60a9377e454f8
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:06:09.565107Z'
published: '2026-02-18'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:47.950Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71234'
references:
  - url: 'https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872'
  - url: 'https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5'
  - url: 'https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf'
  - url: 'https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8'
tags:
  - cve.org
epss: 0.00187
epssPercentile: 0.07799
ingestedAt: '2026-10-16T17:24:46.637Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add

The driver does not set hw->sta_data_size, which causes mac80211 to
allocate insufficient space for driver private station data in
__sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of
struct rtl8xxxu_sta_info through sta->drv_priv, this results in a
slab-out-of-bounds write.

KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:

  BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346
  Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12

Set hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during
probe, similar to how hw->vif_data_size is configured. This ensures
mac80211 allocates sufficient space for the driver's per-station
private data.

Tested on StarFive VisionFive 2 v1.2A board.

## Affected

- `Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 5d810ba377eddee95d30766d360a14efbb3d1872`
- `Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 116f7bd8160c6b37d1c6939385abf90f6f6ed2f5`
- `Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf`
- `Linux >= eef55f1545c92c7181d5083453dee1296298ad3e < 86c946bcc00f6390ef65e9614ae60a9377e454f8`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.