CVE-2025-38448: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38448 is a race condition vulnerability in the Linux kernel's USB gadget serial driver (usb/gadget/u_serial) that can lead to a null pointer exception (NPE) during TTY wakeup operations. It was published on July 25, 2025, and affects Linux kernel versions from 3.5 through multiple stable branches, with fixed versions including 5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, 6.15.7, and 6.16-rc5. Debian Linux 11.0 is also listed as an affected product. The vulnerability carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat CVE, Feedly).

The root cause is a concurrent execution race condition (CWE-362) in the gs_start_io() function within the kernel's USB gadget serial driver. When gs_start_io() calls gs_start_rx() or gs_start_tx(), these functions briefly release the port_lock mutex to call usb_ep_queue(). During this unlocked window, gs_close() can clear port.tty and gserial_disconnect() can clear port_usb on another CPU. When gs_start_rx() reacquires the lock and subsequently calls tty_wakeup(), it dereferences the now-NULL port.tty pointer, resulting in a null pointer exception. The fix replaces the direct tty_wakeup() call with a null-safe TTY Port helper function (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation causes a kernel null pointer dereference, leading to a system crash (kernel panic) and denial of service. The vulnerability affects availability only — there is no confidentiality or integrity impact. Systems using USB gadget serial functionality (e.g., embedded Linux devices, USB OTG-capable systems) are at risk of being crashed by a local user who can trigger concurrent USB serial connect/disconnect and TTY close operations (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability requires local access with low privileges and high attack complexity (timing-dependent race condition), making opportunistic exploitation difficult. The EPSS score is 0.024% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, Red Hat CVE).

Update to a patched Linux kernel version: 5.4.296+, 5.10.240+, 5.15.189+, 6.1.146+, 6.6.99+, 6.12.39+, 6.15.7+, or 6.16-rc5+. Downstream distributions including Debian (DSA-5975-1), Ubuntu (USN-7774, USN-7775, USN-7776, USN-7879, USN-7880, USN-7934 series), and Oracle Linux have released updated kernel packages. As a workaround where patching is not immediately possible, restricting local user access to USB serial gadget devices reduces exposure (Red Hat CVE, Ubuntu USN-7774, Debian DSA-5975).