CVE-2025-71234: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71234 is a slab-out-of-bounds write vulnerability in the rtl8xxxu WiFi driver of the Linux kernel. The driver fails to set hw->sta_data_size, causing the mac80211 subsystem to allocate insufficient memory for driver-private station data; when rtl8xxxu_sta_add() subsequently accesses members of struct rtl8xxxu_sta_info via sta->drv_priv, an out-of-bounds write occurs. Affected kernel versions include 6.9–6.12.71, 6.13–6.18.10, and 6.19.0. The vulnerability was published on 2026-02-18 and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, kernel.org patch).

The root cause is classified as CWE-787 (Out-of-bounds Write). The rtl8xxxu driver omits the initialization of hw->sta_data_size during probe, unlike the analogous hw->vif_data_size which is correctly set. As a result, mac80211's __sta_info_alloc() allocates a station info structure without sufficient trailing space for the driver's private data (struct rtl8xxxu_sta_info). When a new station is added and rtl8xxxu_sta_add() writes to fields accessed through sta->drv_priv, it writes beyond the allocated slab region. The bug was confirmed via a KASAN report on a RISC-V StarFive VisionFive 2 board with an RTL8192EU USB WiFi adapter, showing a write of 8 bytes at an out-of-bounds address by a kernel worker thread (Feedly). Exploitation requires local access with low privileges and has low attack complexity.

Successful exploitation results in kernel memory corruption with high confidentiality, integrity, and availability impact. An attacker with local low-privilege access could corrupt adjacent kernel heap memory, potentially leading to information disclosure of sensitive kernel data, unauthorized modification of kernel structures, or a kernel panic causing a denial of service. The vulnerability is confined to systems using the rtl8xxxu driver with an affected RTL-series WiFi adapter (e.g., RTL8192EU), limiting the affected asset scope to those specific hardware configurations (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing KASAN reports referencing rtl8xxxu_sta_add with messages such as BUG: KASAN: slab-out-of-bounds or Write of size 8 at addr ... by task kworker.
• Process: Unexpected kernel worker thread (kworker) crashes or hangs associated with WiFi station association events on systems using the rtl8xxxu driver.
• System Behavior: Kernel panics or system instability occurring during WiFi client association/disassociation events on hosts with RTL8192EU or similar RTL-series USB WiFi adapters.

Apply patched Linux kernel versions: 6.12.72 or later (for the 6.9–6.12 branch), 6.18.11 or later (for the 6.13–6.18 branch), or 6.19.1 or later (for the 6.19 branch). Patches are available via four stable kernel commits: 116f7bd8, 5d810ba3, 86c946bc, and 9a0f3fa6 (kernel.org patch). Distribution-specific updates have been issued for Debian, SUSE, and Oracle Linux (Debian advisory, SUSE advisory). As a temporary workaround where patching is not immediately possible, disable the rtl8xxxu kernel module (modprobe -r rtl8xxxu) if the RTL-series WiFi adapter is not required, and restrict local unprivileged user access.