HIGH
rtl8xxxu StationInfo Buffer Overflow
CVE-2025-71234
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add The driver does not set hw->sta_data_size, which causes mac80211 to allocate insufficient space for driver private station data in __sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of struct rtl8xxxu_sta_info through sta->drv_priv, this results in a slab-out-of-bounds write. KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter: BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346 Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12 Set hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during probe, similar to how hw->vif_data_size is configured. This ensures mac80211 allocates sufficient space for the driver's per-station private data. Tested on StarFive VisionFive 2 v1.2A board.
02KernelScan AI Analysis
Risk summary
A buffer overflow in the rtl8xxxu WiFi driver can cause memory corruption when WiFi stations connect. This could lead to system crashes or potentially allow attackers within WiFi range to execute code with kernel privileges. The issue affects common USB WiFi adapters and is triggered by normal wireless operations.
Vulnerability analysis
Summary: The rtl8xxxu WiFi driver fails to set hw->sta_data_size, causing mac80211 to allocate insufficient memory for driver private station data. When the driver accesses struct rtl8xxxu_sta_info through sta->drv_priv, it writes beyond the allocated buffer boundaries.
Root Cause: The driver does not initialize hw->sta_data_size during probe, so mac80211's __sta_info_alloc() allocates the default minimal space instead of sizeof(struct rtl8xxxu_sta_info). The introducing commit added station private data structures but forgot to tell mac80211 about the required allocation size.
Attack Surface: This affects systems with Realtek RTL8xxxu USB WiFi adapters when stations are added to the interface. The vulnerability is triggered through normal WiFi operations like station association, making it reachable through wireless network activity.
Fix Mechanism: The patch adds a single line setting hw->sta_data_size = sizeof(struct rtl8xxxu_sta_info) during driver probe, ensuring mac80211 allocates sufficient space for the driver's per-station private data structure.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.72 | 5d810ba377ed |
| 6.18 | 6.18.11 | 116f7bd8160c |
| 6.19 | 6.19.1 | 9a0f3fa6ecd0 |
| mainline | 7.0 | 86c946bcc00f |