CVE-2025-38448: usb: gadget: u_serial: Fix race condition in TTY wakeup
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: userial: Fix race condition in TTY wakeup
A race condition occurs when gsstartio() calls either gsstartrx() or gsstarttx(), as those functions briefly drop the portlock for usbepqueue(). This allows gsclose() and gserialdisconnect() to clear port.tty and portusb, respectively.
Use the null-safe TTY Port helper function to wake up TTY.
Example CPU1: CPU2: gserialconnect() // lock gsclose() // await lock gsstartrx() // unlock usbepqueue() gsclose() // lock, reset port.tty and unlock gsstartrx() // lock ttywakeup() // NPE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38448?
CVE-2025-38448 has a medium severity rating due to the potential for race conditions in TTY wakeup processes.
How do I fix CVE-2025-38448?
To fix CVE-2025-38448, ensure that your Linux kernel is updated to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-38448?
CVE-2025-38448 affects various versions of the Linux kernel that utilize the u_serial USB gadget driver.
What are the potential impacts of CVE-2025-38448?
Exploitation of CVE-2025-38448 could lead to unpredictable behavior in TTY operations, potentially impacting system stability.
Is there any workaround for CVE-2025-38448?
While the recommended action is to update the kernel, temporarily disabling the affected USB gadget functionality may serve as a workaround.