Critical Panic Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-39724: In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to r... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the serial8250 driver, which is responsible for handling serial communication in the kernel. The vulnerability can lead to system instability and crashes, making it crucial for users to address it promptly.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the serial8250 driver that can cause a system panic when the PSLVERR_RESP_EN parameter is set to 1. This occurs when an attempt is made to read an empty Receive Buffer Register (RBR) while the FIFO is enabled. The issue arises during the startup of the serial port, where improper locking mechanisms allow concurrent access to the UART, leading to a failure in checks and ultimately causing a panic. The panic backtrace indicates that the system encounters an unknown exception, resulting in a crash.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can ensure that the serial_port_out function is executed under the port lock to prevent concurrent access issues. This can be done by modifying the source code to include the following:
lock(port->lock);
serial_port_out(port, UART_LCR, UART_LCR_WLEN8);
unlock(port->lock);
However, it is recommended to apply the official patch as soon as possible.
Conclusion
The CVE-2025-39724 vulnerability in the Linux kernel's serial8250 driver poses a significant risk of system panic. Users are strongly encouraged to update their kernel packages to the latest versions to mitigate this issue. Implementing the recommended fixes and workarounds will help maintain system stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39724 is a vulnerability in the Linux kernel's serial8250 driver that can lead to system panic under specific conditions.
This vulnerability can cause your system to crash unexpectedly, leading to potential data loss and service disruption.
Yes, users are advised to update their Linux kernel package to the latest version to apply the necessary fixes.
As a temporary measure, you can implement a workaround by ensuring proper locking mechanisms in the code to prevent concurrent access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
