Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-71229— wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rtw_core_enable_beacon()函数中存在对齐错误，可能导致系统崩溃。

AI Predicted 5.5 Difficulty: Trivial EPSS 0.14% · P3 Updated May 15, 2026

Possible ATT&CK Techniques 1 AI

T1001 · Data Obfuscation

Affected Version Matrix 12

Vendor	Product	Version Range	Status
Linux	Linux	`ad6741b1e0449ba8f4eb41dc28e269dc20ab9219< 71dee092903adb496fe1f357b267d94087b679e0`	affected
		`ad6741b1e0449ba8f4eb41dc28e269dc20ab9219< 7d31dde1bd8678115329e46dc8d7afb63c176b74`	affected
		`ad6741b1e0449ba8f4eb41dc28e269dc20ab9219< 13394550441557115bb74f6de9778c165755a7ab`	affected
		`ad6741b1e0449ba8f4eb41dc28e269dc20ab9219< 653f8b6a091538b084715f259900f62c2ec1c6cf`	affected
		`ad6741b1e0449ba8f4eb41dc28e269dc20ab9219< 0177aa828d966117ea30a44f2e1890fdb356118e`	affected
		`6.5`	affected
		`< 6.5`	unaffected
		`6.6.125≤ 6.6.*`	unaffected
… +4 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-71229

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() rtw_core_enable_beacon() reads 4 bytes from an address that is not a multiple of 4. This results in a crash on some systems. Do 1 byte reads/writes instead. Unable to handle kernel paging request at virtual address ffff8000827e0522 Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000005492000 [ffff8000827e0522] pgd=0000000000000000, p4d=10000001021d9403, pud=10000001021da403, pmd=100000011061c403, pte=00780000f3200f13 Internal error: Oops: 0000000096000021 [#1] SMP Modules linked in: [...] rtw88_8822ce rtw88_8822c rtw88_pci rtw88_core [...] CPU: 0 UID: 0 PID: 73 Comm: kworker/u32:2 Tainted: G W 6.17.9 #1-NixOS VOLUNTARY Tainted: [W]=WARN Hardware name: FriendlyElec NanoPC-T6 LTS (DT) Workqueue: phy0 rtw_c2h_work [rtw88_core] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : rtw_pci_read32+0x18/0x40 [rtw88_pci] lr : rtw_core_enable_beacon+0xe0/0x148 [rtw88_core] sp : ffff800080cc3ca0 x29: ffff800080cc3ca0 x28: ffff0001031fc240 x27: ffff000102100828 x26: ffffd2cb7c9b4088 x25: ffff0001031fc2c0 x24: ffff000112fdef00 x23: ffff000112fdef18 x22: ffff000111c29970 x21: 0000000000000001 x20: 0000000000000001 x19: ffff000111c22040 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffd2cb6507c090 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000007f10 x1 : 0000000000000522 x0 : ffff8000827e0522 Call trace: rtw_pci_read32+0x18/0x40 [rtw88_pci] (P) rtw_hw_scan_chan_switch+0x124/0x1a8 [rtw88_core] rtw_fw_c2h_cmd_handle+0x254/0x290 [rtw88_core] rtw_c2h_work+0x50/0x98 [rtw88_core] process_one_work+0x178/0x3f8 worker_thread+0x208/0x418 kthread+0x120/0x220 ret_from_fork+0x10/0x20 Code: d28fe202 8b020000 f9524400 8b214000 (b9400000) ---[ end trace 0000000000000000 ]---

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	ad6741b1e0449ba8f4eb41dc28e269dc20ab9219 ~ 71dee092903adb496fe1f357b267d94087b679e0	-
Linux	Linux	6.5	-

II. Public POCs for CVE-2025-71229

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-71229

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2025-71229

Same Patch Batch · Linux · 2026-02-18 · 31 CVEs total

CVE-2025-71234	8.8 HIGH	wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
CVE-2026-23230	8.8 HIGH	smb: client: split cached_fid bitfields to avoid shared-byte RMW races
CVE-2026-23226	8.8 HIGH	ksmbd: add chann_lock to protect ksmbd_chann_list xarray
CVE-2026-23227	7.8 HIGH	drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to
CVE-2026-23225	7.8 HIGH	sched/mmcid: Don't assume CID is CPU owned on mode switch
CVE-2026-23224	7.8 HIGH	erofs: fix UAF issue for file-backed mounts w/ directio option
CVE-2026-23222	7.8 HIGH	crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
CVE-2025-71236	7.5 HIGH	scsi: qla2xxx: Validate sp before freeing associated memory
CVE-2025-71235		scsi: qla2xxx: Delay module unload while fabric scan in progress
CVE-2026-23212		bonding: annotate data-races around slave->last_rx
CVE-2026-23229		crypto: virtio - Add spinlock protection with virtqueue notification
CVE-2026-23228		smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
CVE-2025-71225		md: suspend array while updating raid_disks via sysfs
CVE-2026-23223		xfs: fix UAF in xchk_btree_check_block_owner
CVE-2026-23221		bus: fsl-mc: fix use-after-free in driver_override_show()
CVE-2026-23220		ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
CVE-2025-71237		nilfs2: Fix potential block overflow that cause system hang
CVE-2025-71227		wifi: mac80211: don't WARN for connections on invalid channels
CVE-2026-23211		mm, swap: restore swap_space attr aviod kernel panic
CVE-2025-71233		PCI: endpoint: Avoid creating sub-groups asynchronously

Showing top 20 of 31 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2025-71229

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-71229— wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 12

I. Basic Information for CVE-2025-71229

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2025-71229

III. Intelligence Information for CVE-2025-71229

Same Patch Batch · Linux · 2026-02-18 · 31 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2025-71229

Leave a comment