Security readout for executives and security teams
Plain-English summary
A shutdown-ordering flaw in Linux’s RTL8187 USB Wi-Fi driver can let an outstanding USB callback access already-freed network data. The documented result is a kernel null-pointer dereference and system crash. Risk is concentrated on systems using the affected driver; the source bundle does not establish remote reachability or proven code execution.
Executive priority
Treat as a high-priority, hardware-dependent Linux update rather than an enterprise-wide emergency. Quickly identify systems using RTL8187 USB Wi-Fi, then patch critical or multi-user hosts first. The demonstrated business risk is unplanned outage; broader compromise remains possible under the CVSS assessment but is not proven by the supplied evidence.
Technical view
In rtl8187_stop(), transmit-status data was cleared before anchored USB requests were killed. A remaining rtl8187_tx_cb callback could therefore pass a freed skb into mac80211, causing invalid kernel-memory access. The correction reverses that order. Testing reproduced a kernel oops on an RTL8187BvE device. CVSS 3.1 is 7.8 with local, low-privilege access required.
Likely exposure
Potentially exposed systems run an affected Linux kernel and actively use the rtl8187 driver for compatible USB Wi-Fi hardware. The issue was tested on RTL8187BvE, but the bundle does not define every susceptible adapter, distribution package, or configuration. Internet-facing status alone does not establish exposure because the supplied CVSS vector identifies a local attack path.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. The documented evidence is a reproducible kernel crash during driver shutdown behavior. The CVSS vector requires local access with low privileges and no user interaction; reliable privilege escalation, arbitrary code execution, and remote exploitation are not demonstrated in the bundle.
Researcher notes
The failure is a teardown race involving anchored URBs and the transmit-status queue. The source describes callbacks using a freed skb and shows an interrupt-context null dereference. Researchers should distinguish the demonstrated denial of service from the CVSS confidentiality and integrity impacts. Exact affected distribution builds require vendor mapping; upstream commit identifiers alone may not match package versions.
Mitigation direction
- Install a vendor-supported kernel containing the applicable rtl8187 fix.
- Check distribution advisories to map packaged kernels to the listed upstream corrections.
- If immediate patching is impossible, avoid using affected RTL8187 hardware where operationally acceptable.
- Prioritize shared, sensitive, or availability-critical Linux systems using the driver.
Validation and detection
- Inventory Linux systems for loaded or configured rtl8187 driver usage.
- Identify connected RTL8187-compatible USB Wi-Fi adapters, including RTL8187BvE.
- Compare running kernel packages with Linux and distribution security advisories.
- Confirm the applicable stable-kernel correction is present after updating.
- Monitor kernel logs for rtl8187_tx_cb, ieee80211_tx_status_irqsafe, oops, or null dereferences.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38604 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e64732ebff9e24258e7326f07adbe2f2b990daf8CVE reference, Linux
- https://git.kernel.org/stable/c/789415771422f4fb9f444044f86ecfaec55df1bdCVE reference, Linux
- https://git.kernel.org/stable/c/c73c773b09e313278f9b960303a2809b8440bac6CVE reference, Linux
- https://git.kernel.org/stable/c/8c767727f331fb9455b0f81daad832b5925688cbCVE reference, Linux
- https://git.kernel.org/stable/c/14ca6952691fa8cc91e7644512e6ff24a595283fCVE reference, Linux
- https://git.kernel.org/stable/c/7858a95566f4ebf59524666683d2dcdba3fca968CVE reference, Linux
- https://git.kernel.org/stable/c/c51a45ad9070a6d296174fcbe5c466352836c12bCVE reference, Linux
- https://git.kernel.org/stable/c/81cfe34d0630de4e23ae804dcc08fb6f861dc37dCVE reference, Linux
- https://git.kernel.org/stable/c/16d8fd74dbfca0ea58645cd2fca13be10cae3cddCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.