CVE-2025-38448

What it actually does

Race condition in gs_start_io() when calling gs_start_rx() or gs_start_tx() that drops port_lock during usb_ep_queue(), allowing gs_close() or gserial_disconnect() to null port.tty or port_usb before tty_wakeup() executes, resulting in null pointer dereference.

Why it matters to the business

Kernel instability or crashes on Linux systems using USB gadget serial functions, increasing risk of denial of service or local privilege escalation in embedded and IoT deployments with high downstream kernel usage.

How an attack unfolds

Attacker triggers concurrent gserial_connect, gs_start_rx/tx, and gs_close paths on a USB gadget serial port; the unlocked window lets the close path clear TTY structures before wakeup, causing NPE. Threat actors including Advanced Spyware Campaign and groups chaining Linux Kernel Privilege Escalation via CVE-2025-38350, CVE-2025-38477, CVE-2025-37890, and CVE-2025-38083 may leverage this for escalation.

How to fix it

Apply kernel updates containing commit 18d58a467ccf011078352d91b4d6a0108c7318e8 from stable linux.git; for packaged distributions update libcatalyst-authentication-credential-http-perl to 1.018-4 and perl-catalyst/catalyst-authentication-credential-http to ad2c03aad95406db4ce35dfb670664ebde004c18.

How to confirm the fix worked

Verify updated kernel contains the null-safe TTY port helper patch; confirm no TTY wakeup under unlocked port conditions via code review or targeted concurrency tests.

Typical attack path

1. Identify Linux system exposing USB gadget serial interface
2. Obtain local code execution or trigger gadget connect/disconnect sequences
3. Race gs_start_io paths against gs_close or gserial_disconnect
4. Trigger tty_wakeup on cleared port structures to induce NPE or crash
5. Chain resulting kernel context for privilege escalation if possible

How to detect it

Review kernel logs for u_serial, gs_start_rx, gs_start_tx, or tty_wakeup faults during USB gadget activity; correlate with process activity from threat actors exploiting related kernel CVEs.

What your security team should do

• Immediately upgrade affected Linux kernels to the listed fixed commits
• Restrict USB gadget exposure on multi-user or network-adjacent systems
• Monitor EPSS trend and related kernel privilege-escalation activity for prioritization
• Audit embedded device fleets for USB serial gadget usage within 30 days