CVE-2025-40071

tty: n_gsm: Don't block input queue by waiting MSC

State: Published
Severity: Not scored
Published: Oct 28, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: n_gsm: Don't block input queue by waiting MSC

Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used it calls gsm_modem_upd_via_msc() and it cannot block the input queue by waiting the response to come into the same input queue.

Instead allow sending Modem Status Command without waiting for remote end to respond. Define a new function gsm_modem_send_initial_msc() for this purpose. As MSC is only valid for basic encoding, it does not do anything for advanced or when convergence layer type 2 is used.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	48473802506d2d6151f59e0e764932b33b53cb3b to before 8fcc22d6b90304d8b7436e101562218ea3faf73bAffected 48473802506d2d6151f59e0e764932b33b53cb3b to before c36785f9de03df56ff9b8eca30fa681a12b2310dAffected 48473802506d2d6151f59e0e764932b33b53cb3b to before 5416e89b81b00443cb03c88df8da097ae091a141Affected 48473802506d2d6151f59e0e764932b33b53cb3b to before c5a2791a7f11939f05f95c01f0aec0c55bbf28d5Affected 48473802506d2d6151f59e0e764932b33b53cb3b to before 3cf0b3c243e56bc43be560617416c1d9f301f44cAffected 920e849b7d23ced84c9d11e11e2449e34973cfb8Affected e83b4e1540469babeffcfd44a605cf8a61542598Affected 5.15.54 to before 5.16Affected 5.17.6 to before 5.18Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.191 through 6.1.Not affected 6.6.112 through 6.6.Not affected 6.12.53 through 6.12.Not affected 6.17.3 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

48473802506d2d6151f59e0e764932b33b53cb3b to before 8fcc22d6b90304d8b7436e101562218ea3faf73bAffected
48473802506d2d6151f59e0e764932b33b53cb3b to before c36785f9de03df56ff9b8eca30fa681a12b2310dAffected
48473802506d2d6151f59e0e764932b33b53cb3b to before 5416e89b81b00443cb03c88df8da097ae091a141Affected
48473802506d2d6151f59e0e764932b33b53cb3b to before c5a2791a7f11939f05f95c01f0aec0c55bbf28d5Affected
48473802506d2d6151f59e0e764932b33b53cb3b to before 3cf0b3c243e56bc43be560617416c1d9f301f44cAffected
920e849b7d23ced84c9d11e11e2449e34973cfb8Affected
e83b4e1540469babeffcfd44a605cf8a61542598Affected
5.15.54 to before 5.16Affected
5.17.6 to before 5.18Affected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.191 through 6.1.*Not affected
6.6.112 through 6.6.*Not affected
6.12.53 through 6.12.*Not affected
6.17.3 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.