CVE-2025-21689

Summary

CVE-2025-21689 is a vulnerability affecting the Linux kernel. In the USB: serial: quatech2 driver, a null-ptr dereference issue was identified in the function qt2_process_read_urb(). This vulnerability occurred due to an incorrect bounds check in the code, where the condition for the number of ports didn't account for the valid range of the serial->port buffer. When newport was equal to serial->num_ports, an out-of-bounds assignment of "port" led to a NULL pointer dereference. The fix for this issue now checks if newport is greater than or equal to serial->num_ports, preventing the out-of-bounds assignment and subsequent NULL pointer dereference.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.