CVE-2025-71234

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71234
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add The driver does not set hw->sta_data_size, which causes mac80211 to allocate insufficient space for driver private station data in __sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of struct rtl8xxxu_sta_info through sta->drv_priv, this results in a slab-out-of-bounds write. KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter: BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346 Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12 Set hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during probe, similar to how hw->vif_data_size is configured. This ensures mac80211 allocates sufficient space for the driver's per-station private data. Tested on StarFive VisionFive 2 v1.2A board.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5 Patch
https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872 Patch
https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8 Patch
https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

18 Mar 2026, 17:13

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5 - () https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5 - Patch
References () https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872 - () https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872 - Patch
References () https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8 - () https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8 - Patch
References () https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf - () https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Linux linux Kernel
CWE CWE-787

23 Feb 2026, 04:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: wifi: rtl8xxxu: corrección de slab-out-of-bounds en rtl8xxxu_sta_add El controlador no establece hw->sta_data_size, lo que provoca que mac80211 asigne espacio insuficiente para los datos privados de estación del controlador en __sta_info_alloc(). Cuando rtl8xxxu_sta_add() accede a miembros de struct rtl8xxxu_sta_info a través de sta->drv_priv, esto resulta en una escritura slab-out-of-bounds. Informe KASAN en RISC-V (VisionFive 2) con adaptador RTL8192EU: BUG: KASAN: slab-out-of-bounds en rtl8xxxu_sta_add+0x31c/0x346 Escritura de tamaño 8 en la dirección ffffffd6d3e9ae88 por la tarea kworker/u16:0/12 Establecer hw->sta_data_size a sizeof(struct rtl8xxxu_sta_info) durante probe, de forma similar a cómo se configura hw->vif_data_size. Esto asegura que mac80211 asigne espacio suficiente para los datos privados por estación del controlador. Probado en placa StarFive VisionFive 2 v1.2A.
References
  • () https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8 -

18 Feb 2026, 16:22

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-18 16:22

Updated : 2026-03-18 17:13

NVD link : CVE-2025-71234

Mitre link : CVE-2025-71234

CVE.ORG link : CVE-2025-71234

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write