CVE-2025-71234

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add

The driver does not set hw->sta_data_size, which causes mac80211 to

allocate insufficient space for driver private station data in

__sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of

struct rtl8xxxu_sta_info through sta->drv_priv, this results in a

slab-out-of-bounds write.

KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:

BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346

Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12

Set hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during

probe, similar to how hw->vif_data_size is configured. This ensures

mac80211 allocates sufficient space for the driver's per-station

private data.

Tested on StarFive VisionFive 2 v1.2A board.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References