Modem Status Command Blocking Vulnerability in Linux Kernel
Summary
DEBIAN-CVE-2025-40071: In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Don't block input queue by waiting MSC Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services for software applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the tty subsystem, which handles terminal input and output, particularly in the context of the n_gsm protocol used for GSM modem communication.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the tty subsystem related to the n_gsm protocol. The issue arises when the gsm_queue() function processes incoming frames and attempts to open a DLC channel by calling gsm_dlci_open(), which subsequently invokes gsm_modem_update(). In basic mode, this process calls gsm_modem_upd_via_msc(), which incorrectly blocks the input queue while waiting for a Modem Status Command (MSC) response. This blocking behavior can lead to delays and potential denial of service, as the input queue cannot process other incoming data. To address this, a new function, gsm_modem_send_initial_msc(), has been defined to allow sending the MSC without waiting for a remote response, thus preventing input queue blockage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for updates and apply them as soon as they become available.
Conclusion
The vulnerability identified in the Linux kernel's tty subsystem poses a significant risk by blocking the input queue during Modem Status Command processing. It is crucial for users to update their systems to the latest patched version of the Linux kernel to mitigate this risk. Regular monitoring and updates are essential to maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves the blocking of the input queue in the Linux kernel's tty subsystem when waiting for a Modem Status Command response.
All versions of the Linux kernel are affected, as the vulnerability is present from the initial release.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in the latest version of the Linux kernel. Users should update their kernel to the patched version.
The vulnerability can lead to input queue blockage, causing delays and potential denial of service for applications relying on the tty subsystem.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
