Race Condition Vulnerability in Linux Kernel's USB Gadget - CVE-2025-38448
Summary
CVE-2025-38448: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix race condition in TTY wakeup A race condition occurs when gs_start_io() calls either gs_start_rx() or gs_start_tx(), as those... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential functionalities such as process management, memory management, and hardware abstraction. The USB gadget subsystem allows for the creation of USB devices in software, enabling various functionalities. This vulnerability affects the USB gadget's serial driver, specifically the u_serial component, which is responsible for handling serial communication over USB. The vulnerability arises from a race condition that can lead to unexpected behavior and potential system instability.
Vulnerability Detail
In the Linux kernel, a race condition occurs when the gs_start_io() function calls either gs_start_rx() or gs_start_tx(). During this process, the port_lock is briefly dropped, allowing gs_close() and gserial_disconnect() to clear critical pointers such as port.tty and port_usb. This can lead to a null pointer dereference (NPE) when the TTY wakeup function is called, potentially causing system crashes or undefined behavior. The vulnerability is classified under CVE-2025-38448 and affects multiple Debian versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected USB gadget functionalities until the patch is applied. This may involve disabling specific USB gadget drivers or using alternative communication methods.
Conclusion
CVE-2025-38448 is a significant vulnerability in the Linux kernel's USB gadget subsystem that can lead to critical system issues. It is crucial for users to update their systems to the patched version of the Linux kernel to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38448 is a race condition vulnerability in the Linux kernel's USB gadget subsystem that can lead to null pointer dereference and system instability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to system crashes, undefined behavior, and potential security risks due to the instability of the USB gadget functionalities.
Yes, a patch is available. Users should update their Linux kernel package to the latest version that includes the fix for CVE-2025-38448.
If you cannot apply the patch immediately, consider disabling the affected USB gadget functionalities as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
