CVE-2025-71100: wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cutxfilldesc()
TID getting from ieee80211gettid() might be out of range of array size of staentry->tids[], so check TID is less than MAXTIDCOUNT. Othwerwise, UBSAN warn:
UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30 index 10 is out of range for type 'rtltiddata [9]'
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement the fix described for rtlwifi 8192cu: in rtl92cu_tx_fill_desc(), check that the TID value returned/used from ieee80211_get_tid() is less than MAX_TID_COUNT to avoid out-of-bounds access to sta_entry->tids[] (type rtl_tid_data[9]).
Linux kernel (drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c and rtl92cu_tx_fill_desc()) TID bounds check (TID < MAX_TID_COUNT) = Enforce TID < MAX_TID_COUNT before indexing sta_entry->tids[] (array size 9)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71100?
CVE-2025-71100 is classified as a medium severity vulnerability affecting the rtlwifi driver in the Linux kernel.
How do I fix CVE-2025-71100?
To fix CVE-2025-71100, update your Linux kernel to a version that includes the patch addressing the issue.
What versions of the Linux kernel are affected by CVE-2025-71100?
CVE-2025-71100 affects various versions of the Linux kernel using the rtlwifi driver, particularly those prior to the patch release.
What kind of vulnerability is CVE-2025-71100?
CVE-2025-71100 is a potential out of bounds access vulnerability in the rtlwifi driver code.
Can CVE-2025-71100 lead to a system compromise?
While CVE-2025-71100 may not directly lead to system compromise, it poses a risk for instability and potential exploit if left unpatched.