CVE-2025-68362

Root

Cause

In the rtl8187_rx_cb() function of the Linux kernel rtl818x Wi-Fi driver, the receive descriptor header address is computed by subtracting the header size from the skb tail pointer. However, the function fails to verify that the received packet length (skb->len from urb->actual_length) is sufficient to contain the descriptor header. This oversight can lead to a buffer underflow when a deliberately truncated packet is processed.

Exploitation

An attacker capable of injecting crafted, undersized Wi-Fi frames to a system using the RTL8187 wireless chipset can trigger the vulnerability. No authentication is required; the attack is performed over the air by sending malformed frames that result in skb->len being smaller than the expected descriptor header. The function does not validate the packet length before performing the subtraction, causing an out-of-bounds read.

Impact

Successful exploitation results in reading memory located before the start of the skb data area, leading to a kernel panic (denial of service). The vulnerability does not provide arbitrary code execution or privilege escalation based on the description.

Mitigation

The fix adds proper length checks for both RTL8187 and RTL8187B descriptor headers before accessing them, dropping the packet cleanly if the check fails [1]. Users should apply the stable kernel updates that include commit dc153401fb26 or subsequent backports.