The rtl8xxxu wireless driver fails to set the hardware station data size, causing mac80211 to allocate insufficient memory for driver private station data. When the driver subsequently accesses this memory, a slab‑out‑of‑bounds write occurs, as confirmed by a KASAN report on VisionFive 2. This overflow can corrupt kernel memory and may lead to loss of integrity or privilege escalation if exploited. The associated weaknesses are identified as CWE‑476 (null pointer dereference) and CWE‑787 (out‑of‑bounds read or write).

Linux kernel systems that use the rtl8xxxu driver – notably kernel distributions that ship this driver as part of the standard kernel module set. The impact applies to all supported kernel versions that lack the patch setting hw->sta_data_size during probe, with particular exposure on architectures such as RISC‑V where the bug was reproduced.

The CVSS score of 7.8 indicates a high level of severity. However, the EPSS score is reported as < 1 %, showing a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be able to influence the driver’s operation, likely by sending crafted management frames or manipulating the wireless interface, which is a local or remote attack vector depending on device configuration. Given the low EPSS, immediate risk to unpatched systems is moderate but could increase if the flaw becomes widely exploited.