CVE-2025-38284: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38284 is a vulnerability discovered in the Linux kernel affecting the rtw89 PCI WiFi driver. The vulnerability was disclosed on July 10, 2025, and involves issues with configuring manual DAC mode via PCI config API for 36-bit DMA support (NVD).

The vulnerability occurs when attempting to configure chip proprietary bit via PCI config API or chip DBI interface for 36-bit DMA support. The issue arises because the PCI device mmap isn't set yet and the DBI is inaccessible via mmap. When encountering a NULL mmap address, the kernel throws a page fault error for address 0x1090, resulting in a supervisor write access error in kernel mode (Debian Tracker).

The vulnerability can lead to kernel crashes due to page faults, potentially affecting system stability and causing denial of service conditions. The issue specifically impacts systems using the rtw89 PCI WiFi driver (NVD).

The vulnerability has been resolved in various Linux distributions with different patch states. For Debian, the fix status varies by release: bullseye and bookworm are fixed, while trixie and sid remain vulnerable. The fix involves proper handling of DMA configuration when the mmap address is not available (Debian Tracker).