CVE-2025-71229 Overview
CVE-2025-71229 is a memory alignment fault vulnerability in the Linux kernel's rtw88 WiFi driver, specifically within the rtw_core_enable_beacon() function. The vulnerability occurs when the function attempts to read 4 bytes from a memory address that is not aligned to a 4-byte boundary, resulting in a kernel crash on systems with strict alignment requirements.
This vulnerability affects systems using Realtek 802.11ac wireless chips with the rtw88 driver, particularly ARM64-based platforms that enforce strict memory alignment. The fault triggers during WiFi hardware scan operations when processing channel switch commands from firmware.
Critical Impact
Exploitation of this vulnerability leads to immediate kernel panic and system crash, causing denial of service conditions on affected Linux systems running rtw88 WiFi drivers.
Affected Products
- Linux kernel with rtw88 WiFi driver (rtw88_core, rtw88_pci modules)
- Realtek RTW88 series wireless adapters (including RTW8822CE)
- ARM64-based systems with strict memory alignment enforcement
Discovery Timeline
- 2026-02-18 - CVE CVE-2025-71229 published to NVD
- 2026-02-18 - Last updated in NVD database
Technical Details for CVE-2025-71229
Vulnerability Analysis
The vulnerability exists in the rtw_core_enable_beacon() function within the rtw88 WiFi driver subsystem. The function performs a 4-byte read operation via rtw_pci_read32() on an address (0xffff8000827e0522) that is not aligned to a 4-byte boundary. On ARM64 processors and other architectures that enforce strict memory alignment, this misaligned memory access triggers a Data Abort exception with an alignment fault (FSC = 0x21).
The crash occurs in the context of the rtw_c2h_work workqueue when processing Command-to-Host (C2H) messages from the WiFi firmware. The call chain shows the fault propagating through rtw_fw_c2h_cmd_handle() → rtw_hw_scan_chan_switch() → rtw_core_enable_beacon() → rtw_pci_read32().
Root Cause
The root cause is an improper assumption about memory alignment in the rtw88 driver's beacon handling code. The rtw_core_enable_beacon() function directly passes a pointer to rtw_pci_read32() without ensuring the address is 4-byte aligned. On x86 platforms, unaligned memory accesses are handled transparently by the processor with a performance penalty. However, ARM64 and other RISC architectures generate hardware exceptions for misaligned accesses.
The error signature ESR = 0x0000000096000021 indicates an Exception Syndrome Register value corresponding to a Data Abort (EC = 0x25) with an alignment fault status code (FSC = 0x21), confirming the memory alignment violation.
Attack Vector
This vulnerability is triggered locally during normal WiFi operations, specifically during hardware scan procedures when the driver processes beacon-related firmware commands. While the attack vector requires local access to a system with the vulnerable driver, the following conditions can trigger the crash:
- Initiating WiFi scans on systems with rtw88-supported wireless adapters
- Processing C2H firmware commands during channel switching operations
- Any operation that invokes rtw_core_enable_beacon() with misaligned buffer addresses
The fix replaces the 4-byte read/write operations with individual 1-byte operations that do not require alignment, eliminating the alignment fault condition entirely.
Detection Methods for CVE-2025-71229
Indicators of Compromise
- Kernel panic messages containing rtw_pci_read32 in the call trace
- System crashes with error signature ESR = 0x0000000096000021 indicating alignment faults
- Oops messages referencing rtw88_core, rtw88_pci, or rtw_core_enable_beacon modules
- Workqueue crashes in phy0 rtw_c2h_work context
Detection Strategies
- Monitor kernel logs for alignment fault exceptions (FSC = 0x21) associated with WiFi driver operations
- Check for recurring system crashes on ARM64 systems during WiFi scan operations
- Review dmesg output for Internal error: Oops: 0000000096000021 entries
- Audit loaded kernel modules for vulnerable rtw88 driver versions
Monitoring Recommendations
- Enable kernel crash dump collection (kdump) to capture forensic data on affected systems
- Configure log aggregation to alert on kernel panic events involving rtw88 modules
- Monitor system uptime metrics for unexpected reboots on systems with Realtek WiFi adapters
- Implement watchdog timers to detect and report system hangs during WiFi operations
How to Mitigate CVE-2025-71229
Immediate Actions Required
- Update the Linux kernel to a patched version containing the alignment fault fix
- If immediate patching is not possible, consider temporarily disabling the rtw88 WiFi driver
- Use alternative WiFi adapters with different driver implementations on critical systems
- Monitor affected systems for unexpected crashes during WiFi operations
Patch Information
The Linux kernel maintainers have released patches to address this vulnerability. The fix modifies rtw_core_enable_beacon() to perform byte-by-byte memory operations instead of 4-byte accesses, eliminating the alignment requirement. Multiple kernel stable branches have received backported fixes:
Workarounds
- Blacklist the rtw88 driver modules (rtw88_core, rtw88_pci, rtw88_8822c, rtw88_8822ce) if WiFi functionality is not required
- Use USB WiFi adapters with alternative driver support as a temporary solution
- On affected ARM64 systems, consider using wired Ethernet connections until patched kernels are deployed
- Apply kernel live patching solutions if available for your distribution
# Configuration example
# Blacklist rtw88 driver modules to prevent loading
echo "blacklist rtw88_core" >> /etc/modprobe.d/blacklist-rtw88.conf
echo "blacklist rtw88_pci" >> /etc/modprobe.d/blacklist-rtw88.conf
echo "blacklist rtw88_8822c" >> /etc/modprobe.d/blacklist-rtw88.conf
echo "blacklist rtw88_8822ce" >> /etc/modprobe.d/blacklist-rtw88.conf
# Unload currently loaded modules (if system is stable)
modprobe -r rtw88_8822ce rtw88_8822c rtw88_pci rtw88_core
# Update initramfs to persist changes
update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
