CVE-2025-71234
- Source
- https://cve.org/CVERecord?id=CVE-2025-71234
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71234.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-71234
- Downstream
- Published
- 2026-02-18T14:53:18.893Z
- Modified
- 2026-02-23T20:01:18.330724Z
- Summary
- wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxustaadd
The driver does not set hw->stadatasize, which causes mac80211 to allocate insufficient space for driver private station data in _stainfoalloc(). When rtl8xxxustaadd() accesses members of struct rtl8xxxustainfo through sta->drvpriv, this results in a slab-out-of-bounds write.
KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:
BUG: KASAN: slab-out-of-bounds in rtl8xxxustaadd+0x31c/0x346 Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12
Set hw->stadatasize to sizeof(struct rtl8xxxustainfo) during probe, similar to how hw->vifdatasize is configured. This ensures mac80211 allocates sufficient space for the driver's per-station private data.
Tested on StarFive VisionFive 2 v1.2A board.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71234.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/116f7bd8160c6b37d1c6939385abf90f6f6ed2f5
- https://git.kernel.org/stable/c/5d810ba377eddee95d30766d360a14efbb3d1872
- https://git.kernel.org/stable/c/86c946bcc00f6390ef65e9614ae60a9377e454f8
- https://git.kernel.org/stable/c/9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bf
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71234.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-71234
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedeef55f1545c92c7181d5083453dee1296298ad3eFixed5d810ba377eddee95d30766d360a14efbb3d1872Fixed116f7bd8160c6b37d1c6939385abf90f6f6ed2f5Fixed9a0f3fa6ecd0c9c32dbc367a57482bbf7c7d25bfFixed86c946bcc00f6390ef65e9614ae60a9377e454f8