DEBIAN-CVE-2025-21685
- Source
- https://security-tracker.debian.org/tracker/CVE-2025-21685
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21685.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-21685
- Upstream
- Published
- 2025-02-09T12:15:29Z
- Modified
- 2025-09-25T22:40:51Z
- Severity
-
- 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race The yt21380fcserdevprobe() function calls devmserdevdeviceopen() before setting the client ops via serdevdevicesetclientops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receivebuf handler, as it assumes serdev->ops is valid when SERPORTACTIVE is set. This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: crosecuart: properly fix race condition") where devmserdevdeviceopen() was called before fully initializing the device. Fix the race by ensuring client ops are set before enabling the port via devmserdevdeviceopen(). Note, serdevdevicesetbaudrate() and serdevdevicesetflowcontrol() calls should be after the devmserdevdevice_open() call.
- References
Affected packages
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:14 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source