CVE-2025-71234: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxustaadd
The driver does not set hw->stadatasize, which causes mac80211 to allocate insufficient space for driver private station data in stainfoalloc(). When rtl8xxxustaadd() accesses members of struct rtl8xxxustainfo through sta->drvpriv, this results in a slab-out-of-bounds write.
KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:
BUG: KASAN: slab-out-of-bounds in rtl8xxxustaadd+0x31c/0x346 Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12
Set hw->stadatasize to sizeof(struct rtl8xxxustainfo) during probe, similar to how hw->vifdatasize is configured. This ensures mac80211 allocates sufficient space for the driver's per-station private data.
Tested on StarFive VisionFive 2 v1.2A board.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71234?
CVE-2025-71234 is classified as a high severity vulnerability due to the potential for slab-out-of-bounds access.
How do I fix CVE-2025-71234?
To fix CVE-2025-71234, you should update to the latest patched version of the Linux kernel that includes the fix for this vulnerability.
What systems are affected by CVE-2025-71234?
CVE-2025-71234 affects the Linux kernel, specifically systems utilizing the rtl8xxxu driver.
What is the impact of CVE-2025-71234?
The impact of CVE-2025-71234 could lead to potential memory corruption which may allow attackers to execute arbitrary code.
Is there a workaround for CVE-2025-71234 until a patch is applied?
There are no documented workarounds for CVE-2025-71234; updating the kernel is the recommended action.