CVE-2025-38448

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38448
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix race condition in TTY wakeup A race condition occurs when gs_start_io() calls either gs_start_rx() or gs_start_tx(), as those functions briefly drop the port_lock for usb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear port.tty and port_usb, respectively. Use the null-safe TTY Port helper function to wake up TTY. Example CPU1: CPU2: gserial_connect() // lock gs_close() // await lock gs_start_rx() // unlock usb_ep_queue() gs_close() // lock, reset port.tty and unlock gs_start_rx() // lock tty_wakeup() // NPE

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/18d58a467ccf011078352d91b4d6a0108c7318e8 Patch
https://git.kernel.org/stable/c/a5012673d49788f16bb4e375b002d7743eb642d9 Patch
https://git.kernel.org/stable/c/abf3620cba68e0e51e5c21054ce4f925f75b3661 Patch
https://git.kernel.org/stable/c/c529c3730bd09115684644e26bf01ecbd7e2c2c9 Patch
https://git.kernel.org/stable/c/c6eb4a05af3d0ba3bc4e8159287722fb9abc6359 Patch
https://git.kernel.org/stable/c/c8c80a3a35c2e3488409de2d5376ef7e662a2bf5 Patch
https://git.kernel.org/stable/c/d43657b59f36e88289a6066f15bc9a80df5014eb Patch
https://git.kernel.org/stable/c/ee8d688e2ba558f3bb8ac225113740be5f335417 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

22 Dec 2025, 21:53

Type Values Removed Values Added
CWE CWE-362
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/18d58a467ccf011078352d91b4d6a0108c7318e8 - () https://git.kernel.org/stable/c/18d58a467ccf011078352d91b4d6a0108c7318e8 - Patch
References () https://git.kernel.org/stable/c/a5012673d49788f16bb4e375b002d7743eb642d9 - () https://git.kernel.org/stable/c/a5012673d49788f16bb4e375b002d7743eb642d9 - Patch
References () https://git.kernel.org/stable/c/abf3620cba68e0e51e5c21054ce4f925f75b3661 - () https://git.kernel.org/stable/c/abf3620cba68e0e51e5c21054ce4f925f75b3661 - Patch
References () https://git.kernel.org/stable/c/c529c3730bd09115684644e26bf01ecbd7e2c2c9 - () https://git.kernel.org/stable/c/c529c3730bd09115684644e26bf01ecbd7e2c2c9 - Patch
References () https://git.kernel.org/stable/c/c6eb4a05af3d0ba3bc4e8159287722fb9abc6359 - () https://git.kernel.org/stable/c/c6eb4a05af3d0ba3bc4e8159287722fb9abc6359 - Patch
References () https://git.kernel.org/stable/c/c8c80a3a35c2e3488409de2d5376ef7e662a2bf5 - () https://git.kernel.org/stable/c/c8c80a3a35c2e3488409de2d5376ef7e662a2bf5 - Patch
References () https://git.kernel.org/stable/c/d43657b59f36e88289a6066f15bc9a80df5014eb - () https://git.kernel.org/stable/c/d43657b59f36e88289a6066f15bc9a80df5014eb - Patch
References () https://git.kernel.org/stable/c/ee8d688e2ba558f3bb8ac225113740be5f335417 - () https://git.kernel.org/stable/c/ee8d688e2ba558f3bb8ac225113740be5f335417 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

29 Jul 2025, 14:14

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: u_serial: Corrección de la condición de ejecución en la activación de TTY. Una condición de ejecución ocurre cuando gs_start_io() llama a gs_start_rx() o gs_start_tx(), ya que estas funciones desactivan brevemente el port_lock para usb_ep_queue(). Esto permite que gs_close() y gserial_disconnect() borren port.tty y port_usb, respectivamente. Utilice la función auxiliar de puerto TTY segura para nulos para activar TTY. Ejemplo CPU1: CPU2: gserial_connect() // bloquear gs_close() // esperar bloqueo gs_start_rx() // desbloquear usb_ep_queue() gs_close() // bloquear, restablecer port.tty y desbloquear gs_start_rx() // bloquear tty_wakeup() // NPE

25 Jul 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 16:15

Updated : 2025-12-22 21:53

NVD link : CVE-2025-38448

Mitre link : CVE-2025-38448

CVE.ORG link : CVE-2025-38448

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')