CVE-2025-38448

usb: gadget: u_serial: Fix race condition in TTY wakeup

State: Published
Severity: Not scored
Published: Jul 25, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_serial: Fix race condition in TTY wakeup

A race condition occurs when gs_start_io() calls either gs_start_rx() or gs_start_tx(), as those functions briefly drop the port_lock for usb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear port.tty and port_usb, respectively.

Use the null-safe TTY Port helper function to wake up TTY.

Example CPU1: CPU2: gserial_connect() // lock gs_close() // await lock gs_start_rx() // unlock usb_ep_queue() gs_close() // lock, reset port.tty and unlock gs_start_rx() // lock tty_wakeup() // NPE

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before 18d58a467ccf011078352d91b4d6a0108c7318e8Affected 35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before d43657b59f36e88289a6066f15bc9a80df5014ebAffected 35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before a5012673d49788f16bb4e375b002d7743eb642d9Affected 35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before ee8d688e2ba558f3bb8ac225113740be5f335417Affected 35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before c6eb4a05af3d0ba3bc4e8159287722fb9abc6359Affected 35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before abf3620cba68e0e51e5c21054ce4f925f75b3661Affected 35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before c8c80a3a35c2e3488409de2d5376ef7e662a2bf5Affected 35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before c529c3730bd09115684644e26bf01ecbd7e2c2c9Affected
LinuxLinux	3.5Affected before 3.5Not affected 5.4.296 through 5.4.Not affected 5.10.240 through 5.10.Not affected 5.15.189 through 5.15.Not affected 6.1.146 through 6.1.Not affected 6.6.99 through 6.6.Not affected 6.12.39 through 6.12.Not affected 6.15.7 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before 18d58a467ccf011078352d91b4d6a0108c7318e8Affected
35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before d43657b59f36e88289a6066f15bc9a80df5014ebAffected
35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before a5012673d49788f16bb4e375b002d7743eb642d9Affected
35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before ee8d688e2ba558f3bb8ac225113740be5f335417Affected
35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before c6eb4a05af3d0ba3bc4e8159287722fb9abc6359Affected
35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before abf3620cba68e0e51e5c21054ce4f925f75b3661Affected
35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before c8c80a3a35c2e3488409de2d5376ef7e662a2bf5Affected
35f95fd7f234d2b58803bab6f6ebd6bb988050a2 to before c529c3730bd09115684644e26bf01ecbd7e2c2c9Affected

LinuxLinux

3.5Affected
before 3.5Not affected
5.4.296 through 5.4.*Not affected
5.10.240 through 5.10.*Not affected
5.15.189 through 5.15.*Not affected
6.1.146 through 6.1.*Not affected
6.6.99 through 6.6.*Not affected
6.12.39 through 6.12.*Not affected
6.15.7 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.