CVE-2025-21689: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
First published: Mon Feb 10 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following: if (newport > serial->num_ports) { dev_err(&port->dev, "%s - port change to invalid port: %i\n", __func__, newport); break; } The condition doesn't account for the valid range of the serial->port buffer, which is from 0 to serial->num_ports - 1. When newport is equal to serial->num_ports, the assignment of "port" in the following code is out-of-bounds and NULL: serial_priv->current_port = newport; port = serial->port[serial_priv->current_port]; The fix checks if newport is greater than or equal to serial->num_ports indicating it is out-of-bounds.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | >=3.5<5.4.290 | |
| Linux Kernel | >=5.5<5.10.234 | |
| Linux Kernel | >=5.11<5.15.178 | |
| Linux Kernel | >=5.16<6.1.128 | |
| Linux Kernel | >=6.2<6.6.75 | |
| Linux Kernel | >=6.7<6.12.12 | |
| Linux Kernel | =6.13 | |
| Linux Kernel | =6.13-rc1 | |
| Linux Kernel | =6.13-rc2 | |
| Linux Kernel | =6.13-rc3 | |
| Linux Kernel | =6.13-rc4 | |
| Linux Kernel | =6.13-rc5 | |
| Linux Kernel | =6.13-rc6 | |
| Linux Kernel | =6.13-rc7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/fa4c7472469d97c4707698b4c0e098f8cfc2bf22
- https://git.kernel.org/stable/c/94770cf7c5124f0268d481886829dc2beecc4507
- https://git.kernel.org/stable/c/6068dcff7f19e9fa6fa23ee03453ad6a40fa4efe
- https://git.kernel.org/stable/c/4b9b41fabcd38990f69ef0cee9c631d954a2b530
- https://git.kernel.org/stable/c/6377838560c03b36e1153a42ef727533def9b68f
- https://git.kernel.org/stable/c/f371471708c7d997f763b0e70565026eb67cc470
- https://git.kernel.org/stable/c/8542b33622571f54dfc2a267fce378b6e3840b8b
- https://git.kernel.org/stable/c/575a5adf48b06a2980c9eeffedf699ed5534fade
Frequently Asked Questions
What is the severity of CVE-2025-21689?
CVE-2025-21689 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-21689?
To fix CVE-2025-21689, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What versions of the Linux kernel are affected by CVE-2025-21689?
CVE-2025-21689 affects various versions of the Linux kernel prior to the patch being applied.
What impacts does CVE-2025-21689 have on system security?
The null pointer dereference vulnerability in CVE-2025-21689 may lead to system crashes or instability, potentially affecting system reliability.
Is there a workaround for CVE-2025-21689?
There are no known workarounds for CVE-2025-21689; the recommended action is to apply the kernel update as soon as possible.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/references
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/source
- collector/nvd-api
- source/NVD
- agent/event
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- vendor/linux
- canonical/linux kernel
- version/linux kernel/3.5
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.13
- version/linux kernel/6.13-rc1
- version/linux kernel/6.13-rc2
- version/linux kernel/6.13-rc3
- version/linux kernel/6.13-rc4
- version/linux kernel/6.13-rc5
- version/linux kernel/6.13-rc6
- version/linux kernel/6.13-rc7