Null Pointer Dereference in Linux Kernel USB Serial Quatech2 Driver

CVE-2025-21689

Summary

A vulnerability in the USB Serial Quatech2 Driver of the Linux kernel arises from an incorrect bounds check in the qt2_process_read_urb() function. This flaw can lead to a null pointer dereference if the 'newport' variable exceeds the valid range of available ports. Specifically, when 'newport' matches the upper bound of the 'serial->num_ports', an out-of-bounds assignment causes the 'port' variable to dereference a NULL pointer. A patch has been implemented to rectify this issue by adjusting the conditional check to ensure 'newport' does not exceed the valid index range.

References