The rtl8xxxu wireless driver fails to set the hardware station data size, causing mac80211 to allocate insufficient memory for driver private station data. When the driver subsequently accesses this memory, a slab‑out‑of‑bounds write occurs, as confirmed by a KASAN report on VisionFive 2. This overflow can corrupt kernel memory and may lead to loss of integrity or privilege escalation if exploited. The associated weaknesses are identified as CWE‑476 and CWE‑787.

Linux kernel systems that include the rtl8xxxu driver module. The flaw applies to all kernel versions lacking the patch that sets hw->sta_data_size during probe, affecting any distribution that ships this driver as part of the standard kernel image. In particular, systems running the rtl8192EU adapter on architectures such as RISC‑V are documented as reproducing the issue.

The CVSS score of 8.8 indicates high severity, but the EPSS score of < 1 % shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to influence the driver’s operation, most likely by sending crafted wireless management frames or otherwise manipulating the wireless interface; this is inferred from the nature of the driver. The inferred attack vector could be local or remote depending on device configuration. Given the low EPSS, the immediate risk to unpatched systems is moderate but could increase if exploitation becomes more widespread.