CVE-2025-71100High· 7.6▾ Twilight

wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score42/ 100 · Moderate

impact 41.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jan 13, 2026

Updated

Oct 19, 2026

CVSS

7.6

Vendor

Linux

Product

Linux

CWE

—

Depth score

42 · Moderate

EPSS

0.19% · p9

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 286 days

Jan 13, 2026Published
Disclosed via CVEORG
Oct 16, 2026EPSS first tracked
0.2%
Oct 19, 2026Record revised
Last analysed / modified upstream
Oct 26, 2026EPSS peak
0.2% → 0.2%

Linux #cve.org

Affected

Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < 9765d6eb8298b07d499cdf9ef7c237d3540102d6
Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < 90a15ff324645aa806d81fa349497cd964861b66
Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < dd39edb445f07400e748da967a07d5dca5c5f96e
Linux 6.9

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise, UBSAN warn:

UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30 index 10 is out of range for type 'rtl_tid_data [9]'

Affected

Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < 9765d6eb8298b07d499cdf9ef7c237d3540102d6
Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < 90a15ff324645aa806d81fa349497cd964861b66
Linux >= 8ca4cdef93297c9b9bf08da39bc940bd20acbb94 < dd39edb445f07400e748da967a07d5dca5c5f96e
Linux 6.9

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score42/ 100 · Moderate

impact 41.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise, UBSAN warn:

UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30 index 10 is out of range for type 'rtl_tid_data [9]'