CVE-2025-21689

Summary

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()

This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following:

   if (newport > serial->num_ports) {
           dev_err(&port->dev,
                   "%s - port change to invalid port: %i\n",
                   __func__, newport);
           break;
   }

The condition doesn't account for the valid range of the serial->port buffer, which is from 0 to serial->num_ports - 1. When newport is equal to serial->num_ports, the assignment of "port" in the following code is out-of-bounds and NULL:

   serial_priv->current_port = newport;
   port = serial->port[serial_priv->current_port];

The fix checks if newport is greater than or equal to serial->num_ports indicating it is out-of-bounds.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxf7a33e608d9ae022b7f49307921627e34e9484ed < fa4c7472469d97c4707698b4c0e098f8cfc2bf22affected
LinuxLinuxf7a33e608d9ae022b7f49307921627e34e9484ed < 94770cf7c5124f0268d481886829dc2beecc4507affected
LinuxLinuxf7a33e608d9ae022b7f49307921627e34e9484ed < 6068dcff7f19e9fa6fa23ee03453ad6a40fa4efeaffected
LinuxLinuxf7a33e608d9ae022b7f49307921627e34e9484ed < 4b9b41fabcd38990f69ef0cee9c631d954a2b530affected
LinuxLinuxf7a33e608d9ae022b7f49307921627e34e9484ed < 6377838560c03b36e1153a42ef727533def9b68faffected
LinuxLinuxf7a33e608d9ae022b7f49307921627e34e9484ed < f371471708c7d997f763b0e70565026eb67cc470affected
LinuxLinuxf7a33e608d9ae022b7f49307921627e34e9484ed < 8542b33622571f54dfc2a267fce378b6e3840b8baffected
LinuxLinuxf7a33e608d9ae022b7f49307921627e34e9484ed < 575a5adf48b06a2980c9eeffedf699ed5534fadeaffected
LinuxLinux3.5affected
LinuxLinux0 < 3.5unaffected
LinuxLinux5.4.290 <= 5.4.*unaffected
LinuxLinux5.10.234 <= 5.10.*unaffected
LinuxLinux5.15.178 <= 5.15.*unaffected
LinuxLinux6.1.128 <= 6.1.*unaffected
LinuxLinux6.6.75 <= 6.6.*unaffected
LinuxLinux6.12.12 <= 6.12.*unaffected
LinuxLinux6.13.1 <= 6.13.*unaffected
LinuxLinux6.14 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References