Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s Realtek RTL8192CU Wi-Fi driver can access memory outside an expected array when processing an invalid traffic identifier. Systems using this driver may face crashes or other memory-safety effects. The supplied CVSS score is 7.6, driven primarily by potential availability impact.
Executive priority
Treat as a high-priority patching issue for systems actively using RTL8192CU Wi-Fi, especially availability-sensitive endpoints. It is not evidence of an internet-wide emergency: exposure appears hardware- and driver-specific, requires adjacent access, and active exploitation is not documented in the supplied sources.
Technical view
rtl92cu_tx_fill_desc() uses a TID returned by ieee80211_get_tid() to index sta_entry->tids[]. A value such as 10 exceeds the nine-element array. The kernel fix checks that TID is below MAX_TID_COUNT. UBSAN confirmed the out-of-bounds access; the sources do not establish code execution.
Likely exposure
Exposure is limited to Linux systems using the rtlwifi RTL8192CU wireless driver on affected kernels. The CVSS vector indicates an adjacent-network attack surface without privileges or user interaction. The supplied version data is ambiguous, so kernel version alone is insufficient for confirming exposure.
Exploitation context
The bundle provides no evidence of active exploitation, and the CVE is not listed as KEV. The stated attack vector is adjacent, suggesting an attacker must be within a relevant local wireless or network context. No public exploit capability is established by these sources.
Researcher notes
The demonstrated condition is an array-index-out-of-bounds read or write context in transmit descriptor handling, with index 10 against rtl_tid_data[9]. The sources show a bounds-check remediation but do not describe controlled corruption, privilege escalation, or code execution. Version-range interpretation should be verified against distribution advisories and referenced stable commits.
Mitigation direction
- Install a vendor-supported kernel containing the referenced TID bounds-check fix.
- Check distribution security guidance to identify the corrected package for each deployed kernel.
- Disable or replace affected RTL8192CU hardware where prompt kernel updates are impractical.
- Prioritize exposed wireless endpoints and systems where availability is operationally important.
Validation and detection
- Inventory systems using the rtlwifi RTL8192CU driver and associated Realtek USB wireless hardware.
- Record running kernel and distribution package versions on identified systems.
- Confirm the installed kernel contains the referenced fix through vendor advisories or source provenance.
- After updating, verify the corrected kernel is running and the affected driver remains operational.
- Monitor kernel logs for UBSAN array-index warnings or unexplained wireless-related crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-71100 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H2.84.7LinuxVulnerability scoring details
Base CVSS 3.1 score
7.6HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9765d6eb8298b07d499cdf9ef7c237d3540102d6CVE reference, Linux
- https://git.kernel.org/stable/c/90a15ff324645aa806d81fa349497cd964861b66CVE reference, Linux
- https://git.kernel.org/stable/c/dd39edb445f07400e748da967a07d5dca5c5f96eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.