CVE-2025-38159: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38159 Overview

CVE-2025-38159 is an out-of-bounds read vulnerability in the Linux kernel's rtw88 Wi-Fi driver. The flaw resides in the Realtek 802.11ac driver's Bluetooth/Wi-Fi coexistence path, where a para buffer is declared with insufficient size. The buffer is passed to rtw_fw_bt_wifi_control(), which reads five bytes beyond the first element, causing the driver to access memory past the buffer's boundary. The issue was detected using the Svace static analysis tool and has been patched in the mainline kernel.

Critical Impact
A local attacker with low privileges can trigger an out-of-bounds read in kernel memory, potentially disclosing sensitive kernel data or crashing the system, resulting in denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Debian Linux 11.0
Systems using the Realtek rtw88 Wi-Fi driver with Bluetooth coexistence

Discovery Timeline

2025-07-03 - CVE-2025-38159 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38159

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in the rtw88 wireless driver. The driver defines a local para array with a size of 2 bytes in the Bluetooth/Wi-Fi coexistence handling code. However, this array is then passed to the helper function rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1]), which treats the second argument as a pointer to a data buffer of at least 5 bytes.

Inside rtw_fw_bt_wifi_control(), the code accesses *data, *(data + 1), and up to *(data + 4) via the SET_BT_WIFI_CONTROL_DATA1 through SET_BT_WIFI_CONTROL_DATA5 macros. Because para[1] only provides one valid byte, the function reads four additional bytes from adjacent stack memory. The fix increases the para buffer size from 2 to 6 elements, ensuring the callee has sufficient valid memory to read.

Root Cause

The root cause is a mismatch between the caller's buffer allocation and the callee's read expectations. The caller declared u8 para[2] while the callee reads five bytes starting from the supplied pointer. The Linux kernel type system does not encode buffer length in bare pointer parameters, so the compiler could not detect the size mismatch. Static analysis identified the discrepancy across the function boundary.

Attack Vector

Exploitation requires local access with low privileges on a system using the Realtek rtw88 driver. An attacker who can trigger Bluetooth/Wi-Fi coexistence signaling on the affected wireless interface can cause the driver to serialize uninitialized stack memory into a host-to-card (H2C) command packet. The leaked bytes may include kernel stack contents useful for defeating Kernel Address Space Layout Randomization (KASLR) or for chaining with other vulnerabilities. Malformed downstream firmware behavior can also lead to system instability and denial of service.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-38159

Indicators of Compromise

Unexpected kernel warnings or KASAN reports referencing rtw_fw_bt_wifi_control or rtw88 module functions.
Sporadic Wi-Fi interface resets or driver crashes on hosts using Realtek 802.11ac chipsets.
Abnormal H2C command patterns emitted from the rtw88 driver to the wireless firmware.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test and staging kernels to catch out-of-bounds reads in the rtw88 driver.
Inventory kernel versions across Linux fleets and correlate against the fixed commit hashes: 1ee8ea6937d1, 4c2c372de2e1, 68a1037f0bac, 74e18211c2c8, 9febcc8bded8, and c132553894.
Monitor dmesg and journal logs for rtw88 driver warnings, oops entries, or stack traces following wireless activity.

Monitoring Recommendations

Alert on kernel panic and Wi-Fi module reload events on endpoints with Realtek adapters.
Track patch compliance for Debian 11.0 systems against the Debian LTS Announcement.
Baseline normal Wi-Fi driver telemetry so anomalous coexistence activity stands out for investigation.

How to Mitigate CVE-2025-38159

Immediate Actions Required

Apply the upstream kernel patches from the stable trees referenced in the kernel.org commit history.
Update Debian 11.0 hosts through the distribution's LTS security channel to receive the backported fix.
On systems where patching is delayed, unload the rtw88 module if the affected hardware is not in use.

Patch Information

The fix increases the para buffer size from 2 to 6 bytes so that rtw_fw_bt_wifi_control() can safely read the five data bytes it expects. Fixed commits are available across supported stable branches, including 1ee8ea6937d1, 4c2c372de2e1, 68a1037f0bac, 74e18211c2c8, 9febcc8bded8, and c132553894. Debian users should install the kernel packages described in the Debian LTS Announcement.

Workarounds

Disable Bluetooth/Wi-Fi coexistence features on affected devices where the platform allows it.
Blacklist the rtw88 module and use an alternate wireless adapter until the patched kernel is deployed.
Restrict local access to trusted users, as exploitation requires local privileges on the affected host.

bash

# Blacklist the rtw88 driver until the kernel is patched
echo "blacklist rtw88_core" | sudo tee /etc/modprobe.d/blacklist-rtw88.conf
echo "blacklist rtw88_pci"  | sudo tee -a /etc/modprobe.d/blacklist-rtw88.conf
sudo update-initramfs -u
sudo reboot

# Verify the running kernel after applying the vendor patch
uname -r