Executive brief
A vulnerability in the Linux kernel's Realtek Wi-Fi driver could allow an attacker to crash the system or potentially execute unauthorized code. The issue occurs when the driver handles new wireless station connections, failing to reserve enough memory for internal data. This could lead to system instability or a complete service outage for devices using affected Realtek wireless adapters.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the rtl8xxxu Wi-Fi driver within the Linux kernel. The root cause is the driver's failure to initialize the 'sta_data_size' field in the hardware structure during the probe phase. Consequently, the mac80211 subsystem allocates insufficient memory for driver-specific station data in '__sta_info_alloc()'. When 'rtl8xxxu_sta_add()' subsequently attempts to write to this private data area, it performs a slab-out-of-bounds write. This can be triggered by an adjacent attacker via wireless network interactions, potentially leading to a kernel crash or local privilege escalation. Patches have been released for various stable kernel branches including 6.12.72, 6.18.11, and 6.19.1.
Affected products
- Linux Linux Kernel 6.9 to 6.12.72, 6.13 to 6.18.11, 6.19 to 6.19.1
Timeline
- 2025-12-25: disclosed: Initial patch submission by Ali Tariq
- 2026-02-18: advisory: CVE-2025-71234 published
- 2026-02-16: patched: Patches committed to stable kernel trees