CVE-2025-38284: wifi: rtw89: pci: configure manual DAC mode via PCI config API only
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: pci: configure manual DAC mode via PCI config API only
To support 36-bit DMA, configure chip proprietary bit via PCI config API or chip DBI interface. However, the PCI device mmap isn't set yet and the DBI is also inaccessible via mmap, so only if the bit can be accessible via PCI config API, chip can support 36-bit DMA. Otherwise, fallback to 32-bit DMA.
With NULL mmap address, kernel throws trace:
BUG: unable to handle page fault for address: 0000000000001090 #PF: supervisor write access in kernel mode #PF: errorcode(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 71 Comm: irq/26-pciehp Tainted: G OE 6.14.2-061402-generic #202504101348 Tainted: [O]=OOTMODULE, [E]=UNSIGNEDMODULE RIP: 0010:rtw89pciopswrite16+0x12/0x30 [rtw89pci] RSP: 0018:ffffb0ffc0acf9d8 EFLAGS: 00010206 RAX: ffffffffc158f9c0 RBX: ffff94865e702020 RCX: 0000000000000000 RDX: 0000000000000718 RSI: 0000000000001090 RDI: ffff94865e702020 RBP: ffffb0ffc0acf9d8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000015 R13: 0000000000000719 R14: ffffb0ffc0acfa1f R15: ffffffffc1813060 FS: 0000000000000000(0000) GS:ffff9486f3480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000001090 CR3: 0000000090440001 CR4: 00000000000626f0 Call Trace: <TASK> rtw89pcireadconfigbyte+0x6d/0x120 [rtw89pci] rtw89pcicfgdac+0x5b/0xb0 [rtw89pci] rtw89pciprobe+0xa96/0xbd0 [rtw89pci] ? pfxdeviceattachdriver+0x10/0x10 ? pfxdeviceattachdriver+0x10/0x10 localpciprobe+0x47/0xa0 pcicallprobe+0x5d/0x190 pcideviceprobe+0xa7/0x160 reallyprobe+0xf9/0x370 ? pmruntimebarrier+0x55/0xa0 driverprobedevice+0x8c/0x140 driverprobedevice+0x24/0xd0 deviceattachdriver+0xcd/0x170 busforeachdrv+0x99/0x100 deviceattach+0xb4/0x1d0 deviceattach+0x10/0x20 pcibusadddevice+0x59/0x90 pcibusadddevices+0x31/0x80 pciehpconfiguredevice+0xaa/0x170 pciehpenableslot+0xd6/0x240 pciehphandlepresenceorlinkchange+0xf1/0x180 pciehpist+0x162/0x1c0 irqthreadfn+0x24/0x70 irqthread+0xef/0x1c0 ? pfxirqthreadfn+0x10/0x10 ? pfxirqthreaddtor+0x10/0x10 ? pfxirqthread+0x10/0x10 kthread+0xfc/0x230 ? pfxkthread+0x10/0x10 retfromfork+0x47/0x70 ? pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the chip's proprietary 36-bit-DMA bit through the PCI configuration API; do not access the DBI interface through a NULL or unavailable mmap address.
Linux rtw89 PCI driver manual DAC mode / 36-bit DMA chip configuration = Configure via the PCI configuration API only
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38284?
CVE-2025-38284 is classified as a low-severity vulnerability within the Linux kernel.
How do I fix CVE-2025-38284?
To address CVE-2025-38284, update your Linux kernel to the latest version that includes the security patch.
What systems are affected by CVE-2025-38284?
CVE-2025-38284 affects the Linux kernel, specifically the configurations related to PCI device and DAC mode.
What are the potential exploits of CVE-2025-38284?
Exploitation of CVE-2025-38284 could lead to improper configuration of the PCI devices, potentially affecting system stability.
Is there a workaround for CVE-2025-38284?
Currently, the best approach for CVE-2025-38284 is to apply the recommended updates as no direct workarounds are suggested.