CVE-2025-38284
NoneCVSS
—
EPSS
0.2%
Published
Jul 10, 2025
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's handling of certain Wi-Fi cards can crash the entire computer when the hardware is first detected.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
NULL pointer dereference in rtw89_pci_ops_write16 during PCI config access for DAC mode setup when mmap is not initialized, causing kernel page fault and oops on 36-bit DMA fallback path in the rtw89 Wi-Fi PCI driver.
Why it matters to the business
Kernel crashes on systems using affected Realtek Wi-Fi hardware during device enumeration or hotplug events, leading to unplanned reboots, loss of wireless connectivity, and operational downtime until patched kernels are deployed.
How an attack unfolds
An attacker with physical or local access triggers PCIe device presence or link change events (via hotplug or driver reload) that invoke rtw89_pci_probe before the mmap address is valid, forcing the driver through the DBI-inaccessible path and hitting the NULL dereference.
How to fix it
Update the Linux kernel to a version containing commit e1e0f046041474004dc6ebce5ce1d3e86556291d which restricts DAC configuration to the PCI config API path only.
How to confirm the fix worked
Confirm the fixed commit is present in the running kernel source or binary; attempt device probe on affected hardware and verify absence of the page fault oops in dmesg.
Typical attack path
- Insert or trigger presence change on rtw89 PCI Wi-Fi device
- pciehp_handle_presence_or_link_change calls pciehp_configure_device
- pci_device_probe invokes rtw89_pci_probe
- rtw89_pci_cfg_dac calls rtw89_pci_read_config_byte with uninitialized mmap
- rtw89_pci_ops_write16 dereferences NULL address causing page fault and oops
How to detect it
Search kernel logs and dmesg for the page fault oops containing rtw89_pci_ops_write16, rtw89_pci_cfg_dac, and address 0000000000001090 during pciehp or pci_device_probe activity.
- BUG: unable to handle page fault for address: 0000000000001090
- rtw89_pci_ops_write16+0x12/0x30 [rtw89_pci]
- rtw89_pci_cfg_dac+0x5b/0xb0 [rtw89_pci]
- rtw89_pci_probe+0xa96/0xbd0 [rtw89_pci]
- pciehp_configure_device
What your security team should do
- Prioritize kernel updates on all systems using rtw89_pci hardware
- Monitor dmesg and kernel logs for the specific oops signature during boot or hotplug
- Temporarily disable the rtw89_pci module on unpatchable systems if wireless functionality can be sacrificed
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: configure manual DAC mode via PCI config API only To support 36-bit DMA, configure chip proprietary bit via PCI config API or chip DBI interface. However, the PCI device mmap isn't set yet and the DBI is also inaccessible via mmap, so only if the bit can be accessible via PCI config API, chip can support 36-bit DMA. Otherwise, fallback to 32-bit DMA. With NULL mmap address, kernel throws trace: BUG: unable to handle page fault for address: 0000000000001090 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 71 Comm: irq/26-pciehp Tainted: G OE 6.14.2-061402-generic #202504101348 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE RIP: 0010:rtw89_pci_ops_write16+0x12/0x30 [rtw89_pci] RSP: 0018:ffffb0ffc0acf9d8 EFLAGS: 00010206 RAX: ffffffffc158f9c0 RBX: ffff94865e702020 RCX: 0000000000000000 RDX: 0000000000000718 RSI: 0000000000001090 RDI: ffff94865e702020 RBP: ffffb0ffc0acf9d8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000015 R13: 0000000000000719 R14: ffffb0ffc0acfa1f R15: ffffffffc1813060 FS: 0000000000000000(0000) GS:ffff9486f3480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000001090 CR3: 0000000090440001 CR4: 00000000000626f0 Call Trace: <TASK> rtw89_pci_read_config_byte+0x6d/0x120 [rtw89_pci] rtw89_pci_cfg_dac+0x5b/0xb0 [rtw89_pci] rtw89_pci_probe+0xa96/0xbd0 [rtw89_pci] ? __pfx___device_attach_driver+0x10/0x10 ? __pfx___device_attach_driver+0x10/0x10 local_pci_probe+0x47/0xa0 pci_call_probe+0x5d/0x190 pci_device_probe+0xa7/0x160 really_probe+0xf9/0x370 ? pm_runtime_barrier+0x55/0xa0 __driver_probe_device+0x8c/0x140 driver_probe_device+0x24/0xd0 __device_attach_driver+0xcd/0x170 bus_for_each_drv+0x99/0x100 __device_attach+0xb4/0x1d0 device_attach+0x10/0x20 pci_bus_add_device+0x59/0x90 pci_bus_add_devices+0x31/0x80 pciehp_configure_device+0xaa/0x170 pciehp_enable_slot+0xd6/0x240 pciehp_handle_presence_or_link_change+0xf1/0x180 pciehp_ist+0x162/0x1c0 irq_thread_fn+0x24/0x70 irq_thread+0xef/0x1c0 ? __pfx_irq_thread_fn+0x10/0x10 ? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0xfc/0x230 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x47/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | hyperv-daemons-6.12 | 0 | 6.12.58-r1 |
| Chainguard | linux-aws-6.12-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-aws-6.12-fips-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-aws-6.12-headers | 0 | 6.12.58-r0 |
| Chainguard | linux-aws-6.12-modules | 0 | 6.12.58-r0 |
| Chainguard | linux-azure-6.12-boot-installed | 0 | 6.12.58-r1 |
| Chainguard | linux-azure-6.12-fips-boot-installed | 0 | 6.12.58-r1 |
| Chainguard | linux-azure-6.12-headers | 0 | 6.12.58-r1 |
| Chainguard | linux-azure-6.12-modules | 0 | 6.12.58-r1 |
| Chainguard | linux-gcp-6.12-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-fips-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-headers | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-modules | 0 | 6.12.58-r0 |
| Chainguard | linux-qemu-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-modules | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12 | 0 | 6.12.67-r0 |
| Chainguard | linux-vmware-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-modules | 0 | 6.12.63-r0 |
| Debian:13 | linux | 0 | No fix |
| Debian:14 | linux | 0 | 6.16.3-1 |
| Linux | Kernel | 6.11.0 | 6.15.3 |
Related vulnerabilities
- CVE-2025-39910 In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc, mm/kasan… Also affects hyperv-daemons-6.12
- CVE-2025-39925 can: j1939: implement NETDEV_UNREGISTER notification handler Also affects hyperv-daemons-6.12
- CVE-2025-39905 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Also affects hyperv-daemons-6.12
- CVE-2025-39862 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915… Also affects hyperv-daemons-6.12
- CVE-2025-39859 In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix… Also affects hyperv-daemons-6.12
- CVE-2025-39834 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39830 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39833 In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix… Also affects hyperv-daemons-6.12