CVE-2025-68362: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68362 is a buffer underflow vulnerability in the Linux kernel's rtl8187 WiFi driver, specifically within the rtl8187_rx_cb() receive callback function. The flaw was disclosed on December 24, 2025, and affects the Linux kernel from version 2.6.27 onward, with patches available for stable branches including 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with high availability impact (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper input validation (CWE-125, Out-of-bounds Read) in rtl8187_rx_cb(), which computes the rx descriptor header address by subtracting the descriptor size from the socket buffer (skb) tail pointer without first verifying that skb->len (derived from urb->actual_length) is large enough to contain the header. When a truncated or malformed packet is received, this arithmetic results in a pointer that falls before the start of the skb data area — a classic buffer underflow — causing the kernel to read out-of-bounds memory and triggering a kernel panic. The fix adds explicit length checks for both rtl8187 and rtl8187b descriptor headers before any memory access, dropping non-conforming packets cleanly (Red Hat Bugzilla, Feedly).

Successful exploitation causes a kernel panic, resulting in a complete denial of service (system crash) on any Linux host using the rtl8187 USB WiFi adapter driver. There is no confidentiality or integrity impact identified; the primary consequence is loss of availability. Because the vulnerability resides in a kernel driver, a crash affects the entire system rather than a single process or user session (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access or the ability to deliver specially crafted truncated wireless packets to a device using the rtl8187 driver (Feedly).

Apply the upstream Linux kernel patches that add length validation in rtl8187_rx_cb(). Fixed versions include kernel 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Downstream distributions have also issued updates: Debian (linux 6.1.162-1 for oldstable, linux 5.10.249-1 for oldoldstable), Ubuntu (USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), and Oracle Linux (ELSA-2026-50112, ELSA-2026-50145). As a temporary workaround where patching is not immediately possible, unloading or blacklisting the rtl8187 kernel module on systems that do not require the driver will eliminate the attack surface (Red Hat Bugzilla, Feedly).