CVE-2025-38474

What it actually does

The sierra USB network driver validates the presence of three endpoints and bulk in/out endpoints but omits verification that the third endpoint is interrupt input, allowing a malformed endpoint configuration to be accepted.

Why it matters to the business

Linux systems using Sierra USB cellular modems may experience crashes, instability, or denial of service when an unexpected USB device is attached, increasing operational risk for fleets that rely on these modems.

How an attack unfolds

An attacker presents a USB device with three endpoints where the third is not interrupt input; the driver accepts the configuration without the missing check and proceeds with incorrect endpoint handling that can trigger a kernel fault.

How to fix it

Update the Linux kernel to a version containing commit 0a263ccb905b4ae2af381cd4280bd8d2477b98b8 (stable tree) or equivalent fix; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the patch is present by checking for the added endpoint-type validation in drivers/usb/serial/sierra.c; test with a USB device that supplies three endpoints where the third is not interrupt input and verify the driver now rejects it cleanly.

Typical attack path

1. Attacker crafts or emulates a Sierra-compatible USB device lacking a proper interrupt endpoint as the third endpoint
2. Device is attached to a vulnerable Linux system via physical port or forwarded USB
3. sierra driver enumerates endpoints and passes the incomplete validation
4. Driver attempts to use the third endpoint as interrupt input, resulting in invalid memory access or kernel panic

How to detect it

Review kernel logs for sierra driver oops or warnings during USB enumeration; look for unexpected endpoint descriptor mismatches in dmesg or usbmon captures around device attach events.

What your security team should do

• Prioritize kernel updates on systems that expose USB ports to untrusted devices or use Sierra modems
• Apply the fix within standard patch cycles unless the environment has direct USB exposure, then treat as high urgency
• Add USB device allow-listing or endpoint validation monitoring where feasible until patches are deployed