Critical NULL Dereference Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-38646: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band With a quite rare chance, RX report might be problematic to mak... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting system integrity and security. This specific vulnerability affects the Linux kernel packages in Debian 13 and 14, potentially leading to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the wifi driver (rtw89) that can lead to a NULL pointer dereference. This occurs when a problematic packet is received on an unsupported 6 GHz band, causing the software to mistakenly believe it has received a valid packet. As a result, the software fails to initialize necessary components for unsupported bands, leading to a crash. The vulnerability is triggered in the function rtw89_vif_rx_stats_iter(), which can result in a kernel panic, exposing the system to instability and potential denial of service.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability other than updating to the patched versions of the Linux kernel.
Conclusion
The identified NULL dereference vulnerability in the Linux kernel can lead to significant system instability. It is crucial for users of Debian 13 and 14 to update their Linux kernel packages to the patched versions to mitigate this risk. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory at a location that has not been initialized, leading to crashes or unpredictable behavior.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploiting this vulnerability can lead to system crashes, instability, and potential denial of service, affecting the overall performance of the system.
Yes, this vulnerability specifically affects the Linux kernel packages in Debian 13 and 14.
It is recommended to regularly check for updates to your packages, ideally on a weekly basis, to ensure that you have the latest security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
