CVE-2025-38448

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_serial: Fix race condition in TTY wakeup

A race condition occurs when gsstartio() calls either gsstartrx() or gsstarttx(), as those functions briefly drop the portlock for usbepqueue(). This allows gsclose() and gserialdisconnect() to clear port.tty and portusb, respectively.

Use the null-safe TTY Port helper function to wake up TTY.

Example CPU1: CPU2: gserialconnect() // lock gsclose() // await lock gsstartrx() // unlock usbepqueue() gsclose() // lock, reset port.tty and unlock gsstartrx() // lock ttywakeup() // NPE