Executive brief
A vulnerability was identified in the Linux kernel's Realtek RTL818x Wi-Fi driver. The flaw occurs when the driver stops, potentially leading to a system crash (Blue Screen equivalent) or unauthorized access to system memory. This could allow a local user to disrupt operations or compromise the stability of the device.
Technical details
A NULL pointer dereference vulnerability exists in the rtl818x driver (specifically rtl8187) within the Linux kernel. The issue is caused by an incorrect sequence in the rtl8187_stop() function, where the transmit status queue is cleared before anchored USB Request Blocks (URBs) are killed. This race condition allows callbacks to attempt to use socket buffers (skb) that have already been freed, resulting in a kernel oops. A local attacker could exploit this to cause a denial of service or potentially achieve elevated privileges. The issue has been resolved by reordering the teardown sequence to kill anchored URBs before freeing the associated buffers.
Affected products
- Linux Linux Kernel 2.6.29 to 6.15.0
Timeline
- 2025-06-17: disclosed: Initial patch submitted by Daniil Dulov
- 2025-08-15: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2025-08-19: advisory: CVE-2025-38604 published
References
- https://git.kernel.org/stable/c/14ca6952691fa8cc91e7644512e6ff24a595283f
- https://git.kernel.org/stable/c/16d8fd74dbfca0ea58645cd2fca13be10cae3cdd
- https://git.kernel.org/stable/c/7858a95566f4ebf59524666683d2dcdba3fca968
- https://git.kernel.org/stable/c/789415771422f4fb9f444044f86ecfaec55df1bd
- https://git.kernel.org/stable/c/81cfe34d0630de4e23ae804dcc08fb6f861dc37d
- https://git.kernel.org/stable/c/8c767727f331fb9455b0f81daad832b5925688cb
- https://git.kernel.org/stable/c/c51a45ad9070a6d296174fcbe5c466352836c12b