In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_serial: Fix race condition in TTY wakeup
A race condition occurs when gsstartio() calls either gsstartrx() or gsstarttx(), as those functions briefly drop the portlock for usbepqueue(). This allows gsclose() and gserialdisconnect() to clear port.tty and portusb, respectively.
Use the null-safe TTY Port helper function to wake up TTY.
Example CPU1: CPU2: gserialconnect() // lock gsclose() // await lock gsstartrx() // unlock usbepqueue() gsclose() // lock, reset port.tty and unlock gsstartrx() // lock ttywakeup() // NPE
[
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee8d688e2ba558f3bb8ac225113740be5f335417",
"deprecated": false,
"id": "CVE-2025-38448-148f07c1",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d43657b59f36e88289a6066f15bc9a80df5014eb",
"deprecated": false,
"id": "CVE-2025-38448-1ddbfbcf",
"digest": {
"length": 1281.0,
"function_hash": "274271669241480369566719591047895398717"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8c80a3a35c2e3488409de2d5376ef7e662a2bf5",
"deprecated": false,
"id": "CVE-2025-38448-2a97b9fb",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18d58a467ccf011078352d91b4d6a0108c7318e8",
"deprecated": false,
"id": "CVE-2025-38448-361de35b",
"digest": {
"length": 786.0,
"function_hash": "74883722679412571134774307262821319477"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8c80a3a35c2e3488409de2d5376ef7e662a2bf5",
"deprecated": false,
"id": "CVE-2025-38448-362f338a",
"digest": {
"length": 1207.0,
"function_hash": "26606460733852357096957160870125244271"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d43657b59f36e88289a6066f15bc9a80df5014eb",
"deprecated": false,
"id": "CVE-2025-38448-632cead9",
"digest": {
"length": 786.0,
"function_hash": "74883722679412571134774307262821319477"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eb4a05af3d0ba3bc4e8159287722fb9abc6359",
"deprecated": false,
"id": "CVE-2025-38448-633fda3a",
"digest": {
"length": 1177.0,
"function_hash": "30222035616728943331360749680269366702"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8c80a3a35c2e3488409de2d5376ef7e662a2bf5",
"deprecated": false,
"id": "CVE-2025-38448-7a351314",
"digest": {
"length": 860.0,
"function_hash": "225852834992668469921185957613605559373"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee8d688e2ba558f3bb8ac225113740be5f335417",
"deprecated": false,
"id": "CVE-2025-38448-7c045d5d",
"digest": {
"length": 786.0,
"function_hash": "74883722679412571134774307262821319477"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee8d688e2ba558f3bb8ac225113740be5f335417",
"deprecated": false,
"id": "CVE-2025-38448-88c82072",
"digest": {
"length": 1177.0,
"function_hash": "30222035616728943331360749680269366702"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d43657b59f36e88289a6066f15bc9a80df5014eb",
"deprecated": false,
"id": "CVE-2025-38448-9d97a55f",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_tx"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18d58a467ccf011078352d91b4d6a0108c7318e8",
"deprecated": false,
"id": "CVE-2025-38448-a3af59c9",
"digest": {
"length": 1281.0,
"function_hash": "274271669241480369566719591047895398717"
},
"signature_type": "Function"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eb4a05af3d0ba3bc4e8159287722fb9abc6359",
"deprecated": false,
"id": "CVE-2025-38448-c502efe7",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18d58a467ccf011078352d91b4d6a0108c7318e8",
"deprecated": false,
"id": "CVE-2025-38448-e5efab72",
"digest": {
"line_hashes": [
"203703907130120594456991148306965753297",
"228341446550223359252899173746317924198",
"155969923643501650043518573121893938114",
"93209218182760471347340734445896248059",
"5291504185349395609265391779490392682",
"306319544630708779330685474327563145644",
"190476885156586531108131177963234777895",
"251575915089712167396553759162827755442",
"314231033126246321359575688095819367939"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"target": {
"file": "drivers/usb/gadget/function/u_serial.c",
"function": "gs_start_io"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6eb4a05af3d0ba3bc4e8159287722fb9abc6359",
"deprecated": false,
"id": "CVE-2025-38448-ede26237",
"digest": {
"length": 860.0,
"function_hash": "225852834992668469921185957613605559373"
},
"signature_type": "Function"
}
]