In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_serial: Fix race condition in TTY wakeup
A race condition occurs when gsstartio() calls either gsstartrx() or gsstarttx(), as those functions briefly drop the portlock for usbepqueue(). This allows gsclose() and gserialdisconnect() to clear port.tty and portusb, respectively.
Use the null-safe TTY Port helper function to wake up TTY.
Example CPU1: CPU2: gserialconnect() // lock gsclose() // await lock gsstartrx() // unlock usbepqueue() gsclose() // lock, reset port.tty and unlock gsstartrx() // lock ttywakeup() // NPE
[
{
"id": "CVE-2025-38448-148f07c1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee8d688e2ba558f3bb8ac225113740be5f335417",
"signature_type": "Line",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38448-2a97b9fb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8c80a3a35c2e3488409de2d5376ef7e662a2bf5",
"signature_type": "Line",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38448-362f338a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8c80a3a35c2e3488409de2d5376ef7e662a2bf5",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1207.0,
"function_hash": "26606460733852357096957160870125244271"
}
},
{
"id": "CVE-2025-38448-417d0b5e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5012673d49788f16bb4e375b002d7743eb642d9",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 786.0,
"function_hash": "74883722679412571134774307262821319477"
}
},
{
"id": "CVE-2025-38448-633fda3a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eb4a05af3d0ba3bc4e8159287722fb9abc6359",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1177.0,
"function_hash": "30222035616728943331360749680269366702"
}
},
{
"id": "CVE-2025-38448-64db6b4e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abf3620cba68e0e51e5c21054ce4f925f75b3661",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 860.0,
"function_hash": "225852834992668469921185957613605559373"
}
},
{
"id": "CVE-2025-38448-7a351314",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8c80a3a35c2e3488409de2d5376ef7e662a2bf5",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 860.0,
"function_hash": "225852834992668469921185957613605559373"
}
},
{
"id": "CVE-2025-38448-7a49edb1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5012673d49788f16bb4e375b002d7743eb642d9",
"signature_type": "Line",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38448-7c045d5d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee8d688e2ba558f3bb8ac225113740be5f335417",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 786.0,
"function_hash": "74883722679412571134774307262821319477"
}
},
{
"id": "CVE-2025-38448-88c82072",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee8d688e2ba558f3bb8ac225113740be5f335417",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1177.0,
"function_hash": "30222035616728943331360749680269366702"
}
},
{
"id": "CVE-2025-38448-932ab5ff",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5012673d49788f16bb4e375b002d7743eb642d9",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1177.0,
"function_hash": "30222035616728943331360749680269366702"
}
},
{
"id": "CVE-2025-38448-c502efe7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eb4a05af3d0ba3bc4e8159287722fb9abc6359",
"signature_type": "Line",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38448-cf6ddca8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abf3620cba68e0e51e5c21054ce4f925f75b3661",
"signature_type": "Line",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38448-d7e12265",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abf3620cba68e0e51e5c21054ce4f925f75b3661",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1207.0,
"function_hash": "26606460733852357096957160870125244271"
}
},
{
"id": "CVE-2025-38448-ede26237",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eb4a05af3d0ba3bc4e8159287722fb9abc6359",
"signature_type": "Function",
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 860.0,
"function_hash": "225852834992668469921185957613605559373"
}
}
]