CVE-2025-38474: usb: net: sierra: check for no status endpoint
In the Linux kernel, the following vulnerability has been resolved:
usb: net: sierra: check for no status endpoint
The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38474?
The severity of CVE-2025-38474 is classified as medium, given the potential impact on USB communication.
How do I fix CVE-2025-38474?
To fix CVE-2025-38474, update the Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2025-38474?
CVE-2025-38474 affects the Linux kernel, specifically systems utilizing the Sierra USB net driver.
What are the potential risks of CVE-2025-38474?
The potential risks of CVE-2025-38474 include unauthorized access and instability in systems that rely on USB interfaces.
Is there a workaround for CVE-2025-38474?
Currently, there are no known workarounds for CVE-2025-38474 other than applying the kernel updates.