CVE-2025-68362

What it actually does

Buffer underflow in rtl8187_rx_cb() when skb length from urb actual_length is insufficient for descriptor header, causing invalid read before skb data area and kernel panic.

Why it matters to the business

System instability and denial of service on Linux kernels using rtl8187 or rtl8187b WiFi hardware; low prevalence but requires prompt patching on affected devices to maintain uptime.

How an attack unfolds

An attacker transmits truncated 802.11 frames targeting a vulnerable rtl8187 device; the receive callback subtracts descriptor size from skb tail without length validation, triggering underflow and panic.

How to fix it

Upgrade affected Linux kernels to include commit 118e12bf3e4288cf845cd3759bd9d4c99f91aab5; for tigera-operator-fips-1.32 upgrade to version 1.32.13-r6. Rebuild and reboot with patched driver.

How to confirm the fix worked

Confirm presence of explicit skb length checks for rtl8187 and rtl8187b descriptor headers before access in rtl8187_rx_cb(); test with truncated frames to verify graceful drop instead of panic.

Typical attack path

1. Position within wireless range of target rtl8187 device
2. Transmit malformed packets with actual_length smaller than descriptor header
3. Trigger rtl8187_rx_cb() or rtl8187b equivalent without prior length check
4. Induce kernel memory access violation and panic

How to detect it

Search kernel logs and dmesg for rtl8187_rx_cb entries, skb length validation failures, or panics referencing buffer underflow in wireless receive paths; correlate with wireless interface activity.

• rtl8187_rx_cb
• rtl8187b descriptor
• skb tail pointer subtraction
• buffer underflow

What your security team should do

• Apply fixed kernel versions immediately on all systems exposing rtl8187 hardware
• Audit wireless driver usage and disable rtl8187 where feasible until patched
• Monitor kernel logs for rtl8187 receive path errors post-deployment