cve/2025/CVE-2025-21689.md

### [CVE-2025-21689](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21689)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=3.5%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=f7a33e608d9ae022b7f49307921627e34e9484ed%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

In the Linux kernel, the following vulnerability has been resolved:USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()This patch addresses a null-ptr-deref in qt2_process_read_urb() due toan incorrect bounds check in the following:       if (newport > serial->num_ports) {               dev_err(&port->dev,                       "%s - port change to invalid port: %i\n",                       __func__, newport);               break;       }The condition doesn't account for the valid range of the serial->portbuffer, which is from 0 to serial->num_ports - 1. When newport is equalto serial->num_ports, the assignment of "port" in thefollowing code is out-of-bounds and NULL:       serial_priv->current_port = newport;       port = serial->port[serial_priv->current_port];The fix checks if newport is greater than or equal to serial->num_portsindicating it is out-of-bounds.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/w4zu/Debian_security