CVE-2025-38604

What it actually does

Use-after-free in rtl8187 driver: usb_kill_anchored_urbs() called after b_tx_status.queue cleared, allowing ieee80211_tx_status_irqsafe() to dereference freed skb in URB completion path.

Why it matters to the business

Kernel crashes and system instability on Linux hosts with RTL8187 hardware; high urgency due to public kernel commit and multiple downstream packages requiring immediate patching to prevent outages.

How an attack unfolds

Local attacker triggers rtl8187_stop() (via interface down or driver unload) on vulnerable kernel; USB callback fires after skb free, dereferencing NULL and causing panic. Threat actors including VMSCAPE have targeted similar Linux kernel container escape flaws.

How to fix it

Upgrade Linux kernel to commit e64732ebff9e24258e7326f07adbe2f2b990daf8 or later; for Chainguard images update openjdk-17-openj9* packages to 0.53.0-r0. Reboot after kernel update.

How to confirm the fix worked

Verify running kernel contains commit e64732ebff9e24258e7326f07adbe2f2b990daf8; confirm rtl8187 module loads without oops on interface stop; test with RTL8187BvE hardware if available.

Typical attack path

1. Obtain local access or container breakout on affected Linux system
2. Bring down wifi interface or unload rtl8187 module to invoke rtl8187_stop()
3. Trigger USB URB completion after queue clear but before kill
4. Cause NULL pointer dereference in ieee80211_tx_status_irqsafe()

How to detect it

Search kernel logs and dmesg for 'ieee80211_tx_status_irqsafe' and 'NULL pointer dereference' around rtl8187_tx_cb; correlate with interface stop events. Review audit logs for unexpected rtl8187 module unload or container privilege-escalation attempts by listed actors.

What your security team should do

• Immediately apply kernel and package updates listed in fixed_versions due to 434 days public and container-focused threat actors
• Restrict untrusted local access and container workloads on systems with RTL8187 hardware until patched
• Monitor for kernel oops and NULL dereference logs in dmesg
• Prioritize reboot of production hosts after upgrade