Riskcovery

CVE-2025-71100

wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

State
Published
Severity
7.6 High
Published
Jan 13, 2026
Updated
Oct 19, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise, UBSAN warn:

UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30 index 10 is out of range for type 'rtl_tid_data [9]'

Scores

CVSSScoreVectorSource
3.17.6 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 to before 9765d6eb8298b07d499cdf9ef7c237d3540102d6Affected
  • 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 to before 90a15ff324645aa806d81fa349497cd964861b66Affected
  • 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 to before dd39edb445f07400e748da967a07d5dca5c5f96eAffected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.12.64 through 6.12.*Not affected
  • 6.18.4 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.