CVE-2025-38159

What it actually does

The vulnerability is an out-of-bounds read in the rtw88 WiFi driver caused by declaring a 'para' buffer of size 2 instead of 6, allowing the rtw_fw_bt_wifi_control function to access up to 5 bytes beyond the allocated buffer when processing Bluetooth WiFi control operations.

Why it matters to the business

This flaw could allow local attackers to read sensitive kernel memory, potentially leading to information disclosure or aiding further attacks on systems using affected Linux kernels with Realtek wireless hardware, increasing risk in environments with many dependent packages.

How an attack unfolds

An attacker with local access crafts input to trigger the rtw88 driver's Bluetooth WiFi control path, causing the undersized buffer to be passed to a function that reads beyond its bounds, leaking kernel data or crashing the system. Threat actors in advanced spyware campaigns may leverage similar kernel flaws for privilege escalation.

How to fix it

Update the Linux kernel to the fixed commit 1ee8ea6937d13b20f90ff35d71ccc03ba448182d in the stable repository to correct the buffer size in the rtw88 driver.

How to confirm the fix worked

Verify the kernel source includes the commit that sets the 'para' array size to 6 and review the rtw_fw_bt_wifi_control function calls for proper bounds.

Typical attack path

1. Obtain local access to the target system
2. Load or interact with the rtw88 WiFi module to trigger Bluetooth control operations
3. Provide crafted parameters that cause out-of-bounds memory access
4. Read leaked kernel memory or exploit for escalation

How to detect it

Check kernel logs for oops or panic messages related to rtw88 or buffer overruns; monitor for unusual Bluetooth WiFi control operations in system traces. Look for exploitation by advanced spyware campaigns.

What your security team should do

• Prioritize kernel updates on systems with Realtek rtw88 WiFi
• Monitor for local exploit attempts
• Apply the specific commit fix across affected distributions