CVE-2025-21685 platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race
A race condition in the Lenovo Yoga Tab 2 Pro fastcharger driver causes a NULL pointer dereference, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21685?
CVE-2025-21685 is a medium-severity vulnerability in Linux kernel, published on 9 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race
The yt2_1380_fc_serdev_probe() function calls devm_serdev_device_open() before setting the client ops via serdev_device_set_client_ops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receive_buf handler, as it assumes serdev->ops is valid when SERPORT_ACTIVE is set.
This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: properly fix race condition") where devm_serdev_device_open() was called before fully initializing the device.
Fix the race by ensuring client ops are set before enabling the port via devm_serdev_device_open().
Note, serdev_device_set_baudrate() and serdev_device_set_flow_control() calls should be after the devm_serdev_device_open() call.
Weakness: CWE-476
Which versions are affected by CVE-2025-21685?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21685?
Apply the vendor's patch.
Is CVE-2025-21685 being exploited?
There is no known exploitation of CVE-2025-21685 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21685, DEBIAN-CVE-2025-21685, GHSA-j397-m7mx-jcv9, UBUNTU-CVE-2025-21685.