CVE-2025-38448

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_serial: Fix race condition in TTY wakeup

A race condition occurs when gs_start_io() calls either gs_start_rx() or gs_start_tx(), as those functions briefly drop the port_lock for usb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear port.tty and port_usb, respectively.

Use the null-safe TTY Port helper function to wake up TTY.

Example CPU1: CPU2: gserial_connect() // lock gs_close() // await lock gs_start_rx() // unlock usb_ep_queue() gs_close() // lock, reset port.tty and unlock gs_start_rx() // lock tty_wakeup() // NPE

This patch fixes a race condition in the u_serial USB gadget driver, where a NULL pointer dereference could occur if the TTY port is closed or disconnected while gs_start_io() is still in progress. The bug results from a temporary unlock of port_lock, allowing another thread to reset port->tty before tty_wakeup() is called. The patch replaces the direct TTY access with a null-safe helper, tty_port_tty_wakeup().

Although the race is timing-sensitive, it is user-triggerable and may lead to a kernel crash, making it a potential local denial-of-service issue.

Related u_serial Kernel module disabled for all versions of Red Hat Enterprise Linux, and as result not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.