Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-21685— platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在代码问题漏洞，该漏洞源于在启用端口之前没有设置客户端操作，可能导致空指针引用。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.19% · P9

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 6

VendorProduct Version RangeStatus
Linux Linux b2ed33e8d486ab2f1920131dd76fab38c8ef3550< 3f67e07873df3c6d9ce2582260b83732e1d3a40b affected
b2ed33e8d486ab2f1920131dd76fab38c8ef3550< 59616a91e5e74833b2008b56c66879857c616006 affected
6.10 affected
< 6.10 unaffected
6.12.11≤ 6.12.* unaffected
6.13≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21685

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race The yt2_1380_fc_serdev_probe() function calls devm_serdev_device_open() before setting the client ops via serdev_device_set_client_ops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receive_buf handler, as it assumes serdev->ops is valid when SERPORT_ACTIVE is set. This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: properly fix race condition") where devm_serdev_device_open() was called before fully initializing the device. Fix the race by ensuring client ops are set before enabling the port via devm_serdev_device_open(). Note, serdev_device_set_baudrate() and serdev_device_set_flow_control() calls should be after the devm_serdev_device_open() call.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在代码问题漏洞，该漏洞源于在启用端口之前没有设置客户端操作，可能导致空指针引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b2ed33e8d486ab2f1920131dd76fab38c8ef3550 ~ 3f67e07873df3c6d9ce2582260b83732e1d3a40b -
Linux Linux 6.10 -

II. Public POCs for CVE-2025-21685

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21685

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21685 (2)

Same Patch Batch · Linux · 2025-02-09 · 3 CVEs total

CVE-2025-21684 gpio: xilinx: Convert gpio_lock to raw spinlock
CVE-2024-57949 irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21685

No comments yet

Leave a comment