CVE-2025-71100: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71100 is an array-index-out-of-bounds vulnerability in the Linux kernel's rtlwifi driver, specifically in the rtl92cu_tx_fill_desc() function of the RTL8192CU Wi-Fi driver. The flaw arises because the Traffic Identifier (TID) value returned by ieee80211_get_tid() can exceed the bounds of the sta_entry->tids[] array (size 9), triggering a UBSAN warning at drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514. It was published on January 13, 2026, and affects Linux kernel versions 6.9, 6.9.1 through 6.12.63, and 6.13 through 6.18.3, as well as 6.19-rc1 through rc8. The CVSS v3.1 base score is 7.8 (High) (NVD).

The root cause is improper validation of an array index (CWE-129): the TID value obtained from ieee80211_get_tid() is used directly as an index into sta_entry->tids[] without first verifying it is less than MAX_TID_COUNT (9). A TID value of 10 or higher — which is valid in certain 802.11 contexts — causes an out-of-bounds memory access in the kernel's wireless transmit path. The fix adds a bounds check to ensure TID is less than MAX_TID_COUNT before the array dereference. Exploitation requires local access and low privileges, as an attacker would need to trigger specific Wi-Fi transmit operations on a system using the RTL8192CU USB Wi-Fi adapter (NVD, kernel.org patch).

Successful exploitation could result in high confidentiality, integrity, and availability impact on the affected system, as reflected in the CVSS score. An out-of-bounds kernel memory access can lead to kernel crashes (denial of service), memory corruption, or potential information disclosure from kernel memory. In the worst case, memory corruption in kernel space could be leveraged for privilege escalation, though no such exploitation has been demonstrated publicly (NVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-71100. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local attackers with low privileges who have access to a system running the RTL8192CU Wi-Fi driver (NVD).

The Linux kernel maintainers have released patches addressing this vulnerability. Fixed versions include Linux kernel 6.12.64 (for the 6.9.1–6.12.x branch) and 6.18.4 (for the 6.13–6.18.x branch), with the fix also included in 6.19-rc4 and later. Ubuntu has issued security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 addressing this issue. Users should update their Linux kernel to a patched version as soon as possible; as a temporary workaround, systems not requiring the RTL8192CU USB Wi-Fi adapter can blacklist the rtl8192cu kernel module to prevent the vulnerable code path from being loaded (NVD, Ubuntu USN-8177-1, Ubuntu USN-8183-1).

Ubuntu issued multiple security notices (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1) addressing this and related kernel vulnerabilities, indicating active downstream patching activity. The Yocto Project security mailing list also tracked this CVE across several messages. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability (Ubuntu USN-8177-1, Ubuntu USN-8183-1).