CVE-2025-38159 – This CVE describes an out-of-bounds read vulner... (How to Fix)

Q: What is the severity of CVE-2025-38159?

CVE-2025-38159 has a CVSS score of 7.1 (HIGH). This CVE describes an out-of-bounds read vulnerability in the Linux kernel's rtw88 WiFi driver. An attacker could potentially read kernel memory beyond the allocated buffer, leading to information disclosure or system instability. This affects Linux systems using the rtw88 driver for Realtek WiFi chips.

📋 TL;DR

This CVE describes an out-of-bounds read vulnerability in the Linux kernel's rtw88 WiFi driver. An attacker could potentially read kernel memory beyond the allocated buffer, leading to information disclosure or system instability. This affects Linux systems using the rtw88 driver for Realtek WiFi chips.

💻 Affected Systems

Products:

Linux kernel with rtw88 driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using Realtek WiFi chips supported by the rtw88 driver. Requires the driver to be loaded and active.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to privilege escalation, system crash, or information leakage of sensitive kernel data.

🟠

Likely Case

System instability, kernel panic, or denial of service due to reading invalid memory addresses.

🟢

If Mitigated

Limited impact with proper kernel protections and exploit mitigations in place.

🌐 Internet-Facing: LOW - Requires local access or WiFi proximity exploitation.

🏢 Internal Only: MEDIUM - Local attackers could exploit this to gain information or cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access or ability to interact with WiFi interface. Static analysis tool detection suggests potential for exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 1ee8ea6937d13b20f90ff35d71ccc03ba448182d or later

Vendor Advisory: https://git.kernel.org/stable/c/1ee8ea6937d13b20f90ff35d71ccc03ba448182d

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable rtw88 driver

linux

Unload the vulnerable driver if not needed

sudo modprobe -r rtw88_core
sudo modprobe -r rtw88_pci
sudo modprobe -r rtw88_usb

Blacklist driver

linux

Prevent driver from loading at boot

echo 'blacklist rtw88_core' | sudo tee /etc/modprobe.d/blacklist-rtw88.conf
echo 'blacklist rtw88_pci' | sudo tee -a /etc/modprobe.d/blacklist-rtw88.conf
echo 'blacklist rtw88_usb' | sudo tee -a /etc/modprobe.d/blacklist-rtw88.conf

🧯 If You Can't Patch

Restrict physical and network access to systems
Use kernel hardening features like KASLR and stack protection

🔍 How to Verify

Check if Vulnerable:

Check if rtw88 driver is loaded: lsmod | grep rtw88

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix: uname -r and verify against patched versions

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes related to WiFi
dmesg errors mentioning rtw88

Network Indicators:

Unusual WiFi driver behavior

SIEM Query:

source="kernel" AND ("rtw88" OR "oops" OR "panic")

📊 Metadata

CVE ID: CVE-2025-38159

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

EPSS Score: 0.02% exploit probability (4.3th percentile)

Published: July 3, 2025

Last Updated: December 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38159, you might also want to check these: