{"id":"CVE-2025-71234","revision":"2f7ed82ae576460896bef1ac72eaee5b","records":[{"revision":"2f7ed82ae576460896bef1ac72eaee5b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71234","aliases":[],"title":"wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add\n\nThe driver does not set hw->sta_data_size, which causes mac80211 to\nallocate insufficient space for driver private station data in\n__sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of\nstruct rtl8xxxu_sta_info through sta->drv_priv, this results in a\nslab-out-of-bounds write.\n\nKASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:\n\n  BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346\n  Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12\n\nSet hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during\nprobe, similar to how hw->vif_data_size is configured. This ensures\nmac80211 allocates sufficient space for the driver's per-station\nprivate data.\n\nTested on StarFive VisionFive 2 v1.2A board.","state":0,"publishedAt":"2026-02-18T14:53:18.893+00:00","modifiedAt":"2026-10-19T18:25:24.435+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/realtek/rtl8xxxu/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"eef55f1545c92c7181d5083453dee1296298ad3e\",\n                            \"lessThan\": \"5d810ba377eddee95d30766d360a14efbb3d1872\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eef55f1545c92c7181d5083453dee1296298ad3e\",\n                            \"lessThan\": \"116f7bd8160c6b37d1c6939385abf90f6f6ed2f5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eef55f1545c92c7181d5083453dee1296298ad3e\",\n                            \"lessThan\": \"9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eef55f1545c92c7181d5083453dee1296298ad3e\",\n                            \"lessThan\": \"86c946bcc00f6390ef65e9614ae60a9377e454f8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/realtek/rtl8xxxu/core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.72\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.11\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.1\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872","https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5","https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf","https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71234","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71234","identifiers":["CVE-2025-71234"]},"retained":false,"historicalAffected":[]}],"coverage":[]}