Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-21689— USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在处理USB串行设备时，对新端口数值的边界检查不正确，导致空指针引用。

AI Predicted 5.9 Difficulty: Moderate EPSS 0.23% · P13

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux f7a33e608d9ae022b7f49307921627e34e9484ed< fa4c7472469d97c4707698b4c0e098f8cfc2bf22 affected
f7a33e608d9ae022b7f49307921627e34e9484ed< 94770cf7c5124f0268d481886829dc2beecc4507 affected
f7a33e608d9ae022b7f49307921627e34e9484ed< 6068dcff7f19e9fa6fa23ee03453ad6a40fa4efe affected
f7a33e608d9ae022b7f49307921627e34e9484ed< 4b9b41fabcd38990f69ef0cee9c631d954a2b530 affected
f7a33e608d9ae022b7f49307921627e34e9484ed< 6377838560c03b36e1153a42ef727533def9b68f affected
f7a33e608d9ae022b7f49307921627e34e9484ed< f371471708c7d997f763b0e70565026eb67cc470 affected
f7a33e608d9ae022b7f49307921627e34e9484ed< 8542b33622571f54dfc2a267fce378b6e3840b8b affected
f7a33e608d9ae022b7f49307921627e34e9484ed< 575a5adf48b06a2980c9eeffedf699ed5534fade affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21689

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following: if (newport > serial->num_ports) { dev_err(&port->dev, "%s - port change to invalid port: %i\n", __func__, newport); break; } The condition doesn't account for the valid range of the serial->port buffer, which is from 0 to serial->num_ports - 1. When newport is equal to serial->num_ports, the assignment of "port" in the following code is out-of-bounds and NULL: serial_priv->current_port = newport; port = serial->port[serial_priv->current_port]; The fix checks if newport is greater than or equal to serial->num_ports indicating it is out-of-bounds.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在处理USB串行设备时，对新端口数值的边界检查不正确，导致空指针引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux f7a33e608d9ae022b7f49307921627e34e9484ed ~ fa4c7472469d97c4707698b4c0e098f8cfc2bf22 -
Linux Linux 3.5 -

II. Public POCs for CVE-2025-21689

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21689

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21689 (8)

Same Patch Batch · Linux · 2025-02-10 · 8 CVEs total

CVE-2025-21687 7.8 HIGH vfio/platform: check the bounds of read/write syscalls
CVE-2025-21692 7.8 HIGH net: sched: fix ets qdisc OOB Indexing
CVE-2025-21693 7.8 HIGH mm: zswap: properly synchronize freeing resources during CPU hotunplug
CVE-2024-57950 drm/amd/display: Initialize denominator defaults to 1
CVE-2025-21688 drm/v3d: Assign job pointer to NULL before signaling the fence
CVE-2025-21690 scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
CVE-2025-21691 cachestat: fix page cache statistics permission checking

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21689

No comments yet

Leave a comment