CVE-2025-38646
📋 TL;DR
A NULL pointer dereference vulnerability in the Linux kernel's rtw89 WiFi driver allows a kernel panic when receiving malformed packets on unsupported 6 GHz bands. This affects Linux systems using Realtek rtw89 WiFi chips that don't support 6 GHz bands. The vulnerability can cause system crashes but doesn't allow arbitrary code execution.
💻 Affected Systems
- Linux kernel with rtw89 WiFi driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, requiring physical or remote console access to reboot.
Likely Case
System crash when receiving specific malformed WiFi packets, causing temporary service disruption until reboot.
If Mitigated
No impact if patched or if system doesn't use rtw89 WiFi drivers.
🎯 Exploit Status
Exploitation requires ability to send malformed WiFi packets to target system. No authentication needed but requires network proximity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel with commit 4b525630729082f026e7030eafccf89e3add7eae or later
Vendor Advisory: https://git.kernel.org/stable/c/4b525630729082f026e7030eafccf89e3add7eae
Restart Required: No
Instructions:
1. Update Linux kernel to version containing the fix commit. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel. 3. Rebuild kernel if compiling from source with patched code.
🔧 Temporary Workarounds
Disable rtw89 WiFi driver
LinuxBlacklist or disable the rtw89 kernel module to prevent loading
echo 'blacklist rtw89_core' >> /etc/modprobe.d/blacklist-rtw89.conf
update-initramfs -u
reboot
Disable WiFi interface
LinuxTurn off WiFi to prevent receiving malicious packets
ip link set wlan0 down
rfkill block wifi
🧯 If You Can't Patch
- Disable WiFi functionality on affected systems
- Implement network segmentation to isolate WiFi traffic from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check if rtw89_core module is loaded: lsmod | grep rtw89_core. If loaded and kernel version is vulnerable, system is at risk.Check Version:
uname -rVerify Fix Applied:
Check kernel version contains fix commit: grep -q '4b525630729082f026e7030eafccf89e3add7eae' /proc/version || uname -r📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs mentioning rtw89_vif_rx_stats_iter
- NULL pointer dereference at 0000000000000032
- BUG: kernel NULL pointer dereference in rtw89_core
Network Indicators:
- Unusual WiFi packet patterns targeting 6 GHz bands on non-6GHz hardware
SIEM Query:
event_source:kernel AND (message:"NULL pointer dereference" AND message:"rtw89") OR (message:"BUG: kernel NULL pointer dereference" AND process:"rtw89")🔗 References
- https://git.kernel.org/stable/c/4b525630729082f026e7030eafccf89e3add7eae
- https://git.kernel.org/stable/c/77a7a48f87d673a68664bebf044214821decbfda
- https://git.kernel.org/stable/c/7e04f01bb94fe61c73cc59f0495c3b6c16a83231
- https://git.kernel.org/stable/c/892b29eab44b1803d2cad8e50f1bc2144ef478cb
- https://git.kernel.org/stable/c/f3527ac15a00916e68ecb495b74dbe6a6c62a06f
