CVE-2025-71234 wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
A slab-out-of-bounds write in the rtl8xxxu WiFi driver allows attackers to cause memory corruption, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71234?
CVE-2025-71234 is a high-severity memory corruption vulnerability in Linux kernel, published on 18 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
The driver does not set hw->sta_data_size, which causes mac80211 to allocate insufficient space for driver private station data in __sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of struct rtl8xxxu_sta_info through sta->drv_priv, this results in a slab-out-of-bounds write.
KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:
BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346 Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12
Set hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during probe, similar to how hw->vif_data_size is configured. This ensures mac80211 allocates sufficient space for the driver's per-station private data.
Tested on StarFive VisionFive 2 v1.2A board.
Weakness: CWE-787
Which versions are affected by CVE-2025-71234?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71234?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-71234 being exploited?
There is no known exploitation of CVE-2025-71234 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71234, DEBIAN-CVE-2025-71234, GHSA-365g-rr2h-rx65, ROOT-OS-DEBIAN-11-CVE-2025-71234, ROOT-OS-DEBIAN-12-CVE-2025-71234, UBUNTU-CVE-2025-71234.