CVE-2025-38604

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38604
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38604.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38604
Downstream
Related
Published
2025-08-19T17:03:43.358Z
Modified
2026-03-20T12:42:56.228105Z
Summary
wifi: rtl818x: Kill URBs before clearing tx status queue
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtl818x: Kill URBs before clearing tx status queue

In rtl8187stop() move the call of usbkillanchoredurbs() before clearing btxstatus.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb.

BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 RIP: 0010:ieee80211txstatusirqsafe+0x21/0xc0 [mac80211] Call Trace: <IRQ> rtl8187txcb+0x116/0x150 [rtl8187] __usbhcdgiveback_urb+0x9d/0x120 usbgivebackurbbh+0xbb/0x140 processonework+0x19b/0x3c0 bhworker+0x1a7/0x210 taskletaction+0x10/0x30 handlesoftirqs+0xf0/0x340 _irqexitrcu+0xcd/0xf0 commoninterrupt+0x85/0xa0 </IRQ>

Tested on RTL8187BvE device.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38604.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c1db52b9d27ee6e15a7136e67e4a21dc916cd07f
Fixed
e64732ebff9e24258e7326f07adbe2f2b990daf8
Fixed
789415771422f4fb9f444044f86ecfaec55df1bd
Fixed
c73c773b09e313278f9b960303a2809b8440bac6
Fixed
8c767727f331fb9455b0f81daad832b5925688cb
Fixed
14ca6952691fa8cc91e7644512e6ff24a595283f
Fixed
7858a95566f4ebf59524666683d2dcdba3fca968
Fixed
c51a45ad9070a6d296174fcbe5c466352836c12b
Fixed
81cfe34d0630de4e23ae804dcc08fb6f861dc37d
Fixed
16d8fd74dbfca0ea58645cd2fca13be10cae3cdd

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38604.json"