Critical Vulnerability in Linux Kernel: USB Sierra Driver Endpoint Check
Summary
CVE-2025-38474: In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware and system resources. It provides essential services for all other parts of the system, including device drivers, system calls, and process management. The kernel is crucial for the stability and performance of Linux-based systems. The vulnerability in question affects the USB Sierra driver, which is responsible for managing USB devices that utilize Sierra Wireless technology. This driver is designed to handle communication with these devices, ensuring proper data transfer and device management.
Vulnerability Detail
The vulnerability, identified as CVE-2025-38474, arises from an oversight in the USB Sierra driver where it fails to verify that the third endpoint is an interrupt input. While the driver checks for the presence of three endpoints and ensures that the bulk in and out endpoints are correctly configured, it neglects to validate the type of the third endpoint. This omission can lead to improper handling of USB devices, potentially allowing for denial-of-service attacks or other unexpected behaviors. The vulnerability has been resolved in subsequent patches, but systems running affected versions remain at risk until updated.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the USB Sierra driver if it is not essential for their operations. This can be done by blacklisting the driver in the system configuration. To do this, add the following line to the '/etc/modprobe.d/blacklist.conf' file: 'blacklist sierra'. This will prevent the driver from loading until a proper fix is applied.
Conclusion
CVE-2025-38474 is a critical vulnerability in the Linux kernel's USB Sierra driver that can lead to improper device handling. It is essential for users to update their systems to the latest patched version to mitigate risks. Temporary workarounds are available, but applying the patch is the most effective solution.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38474 is a vulnerability in the Linux kernel's USB Sierra driver that arises from a failure to check the type of the third endpoint, potentially leading to improper device handling.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
The risks include potential denial-of-service attacks and unexpected behavior when interacting with USB devices managed by the Sierra driver.
Yes, a patch has been released for the Linux kernel that addresses this vulnerability. Updating to the latest version of the Linux package will apply the fix.
If immediate updates are not possible, consider blacklisting the USB Sierra driver as a temporary workaround to mitigate the risk until a proper update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
