logo_clicknbuy.png

CVE-2025-38604 – “RTL8187: Null Pointer Dereference in Wireless Driver”

The following table lists the changes that have been made to the
CVE-2025-38604 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 19, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved:

    wifi: rtl818x: Kill URBs before clearing tx status queue

    In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing
    b_tx_status.queue. This change prevents callbacks from using already freed
    skb due to anchor was not killed before freeing such skb.

    BUG: kernel NULL pointer dereference, address: 0000000000000080
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) – not-present page
    PGD 0 P4D 0
    Oops: Oops: 0000 [#1] SMP NOPTI
    CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary)
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
    RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211]
    Call Trace:

    rtl8187_tx_cb+0x116/0x150 [rtl8187]
    __usb_hcd_giveback_urb+0x9d/0x120
    usb_giveback_urb_bh+0xbb/0x140
    process_one_work+0x19b/0x3c0
    bh_worker+0x1a7/0x210
    tasklet_action+0x10/0x30
    handle_softirqs+0xf0/0x340
    __irq_exit_rcu+0xcd/0xf0
    common_interrupt+0x85/0xa0

    Tested on RTL8187BvE device.

    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    Added Reference https://git.kernel.org/stable/c/14ca6952691fa8cc91e7644512e6ff24a595283f
    Added Reference https://git.kernel.org/stable/c/16d8fd74dbfca0ea58645cd2fca13be10cae3cdd
    Added Reference https://git.kernel.org/stable/c/7858a95566f4ebf59524666683d2dcdba3fca968
    Added Reference https://git.kernel.org/stable/c/81cfe34d0630de4e23ae804dcc08fb6f861dc37d
    Added Reference https://git.kernel.org/stable/c/8c767727f331fb9455b0f81daad832b5925688cb
    Added Reference https://git.kernel.org/stable/c/c51a45ad9070a6d296174fcbe5c466352836c12b
Share the Post:

Related Posts