CVE-2025-38604 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2025-38604?

CVE-2025-38604 has a CVSS score of 5.5 (MEDIUM). A use-after-free vulnerability in the Linux kernel's RTL8187/8187B USB WiFi driver allows a NULL pointer dereference when stopping the device. This can cause kernel panics or system crashes on systems using affected WiFi hardware. The vulnerability affects Linux systems with RTL8187/8187B USB WiFi adapters.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's RTL8187/8187B USB WiFi driver allows a NULL pointer dereference when stopping the device. This can cause kernel panics or system crashes on systems using affected WiFi hardware. The vulnerability affects Linux systems with RTL8187/8187B USB WiFi adapters.

💻 Affected Systems

Products:

Linux kernel with rtl8187 driver

Versions: Linux kernel versions before fixes in stable trees (specific commits listed in references)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using RTL8187 or RTL8187B USB WiFi adapters. Requires the rtl8187 driver to be loaded and active.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

System crash or kernel panic when stopping/restarting WiFi interface, requiring reboot to restore functionality.

🟢

If Mitigated

Minor service interruption during WiFi interface management operations.

🌐 Internet-Facing: LOW - Requires physical or local access to USB WiFi device, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local users with USB WiFi device access could cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires physical or local access to trigger WiFi interface stop operations. No remote exploitation vector identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel stable releases containing commits: 14ca6952691fa8cc91e7644512e6ff24a595283f, 16d8fd74dbfca0ea58645cd2fca13be10cae3cdd, 7858a95566f4ebf59524666683d2dcdba3fca968, 789415771422f4fb9f444044f86ecfaec55df1bd, 81cfe34d0630de4e23ae804dcc08fb6f861dc37d

Vendor Advisory: https://git.kernel.org/stable/c/14ca6952691fa8cc91e7644512e6ff24a595283f

Restart Required: No

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager to update kernel package. 3. Rebuild kernel if using custom kernel. 4. No reboot required for driver reload, but kernel update may require reboot.

🔧 Temporary Workarounds

Disable rtl8187 driver

all

Prevent loading of vulnerable driver module

echo 'blacklist rtl8187' >> /etc/modprobe.d/blacklist.conf
rmmod rtl8187

Avoid using affected WiFi adapters

all

Disconnect RTL8187/8187B USB WiFi adapters

🧯 If You Can't Patch

Disconnect RTL8187/8187B USB WiFi adapters from vulnerable systems
Avoid stopping/restarting WiFi interfaces on systems with affected hardware

🔍 How to Verify

Check if Vulnerable:

Check if rtl8187 driver is loaded: lsmod | grep rtl8187. Check kernel version: uname -r and compare with patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Check dmesg for absence of NULL pointer dereference errors related to rtl8187.

📡 Detection & Monitoring

Log Indicators:

Kernel NULL pointer dereference errors in dmesg/syslog
Oops messages with rtl8187_tx_cb or ieee80211_tx_status_irqsafe in call trace
System crash/panic logs when stopping WiFi

Network Indicators:

Sudden WiFi interface disappearance
Unexpected network disconnections

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "Oops") AND ("rtl8187" OR "ieee80211_tx_status")

📊 Metadata

CVE ID: CVE-2025-38604

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.01% exploit probability (2.3th percentile)

Published: August 19, 2025

Last Updated: January 7, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38604, you might also want to check these: