CVE-2025-21746

Input: synaptics - fix crash when enabling pass-through port

MEDIUM
4.7
CVSS Score
Published: February 27, 2025 at 02:12 AM UTC
Updated: June 17, 2026 at 08:44 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM4.7
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics sub-driver tries to access psmouse instance presumably associated with the pass-through port to figure out if only 1 byte of response or entire protocol packet needs to be forwarded to the pass-through port and may crash if psmouse instance has not been attached to the port yet. Fix the crash by introducing open() and close() methods for the port and check if the port is open before trying to access psmouse instance. Because psmouse calls serio_open() only after attaching psmouse instance to serio port instance this prevents the potential crash.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.13 ≤ v < 6.13.36.5 ≤ v < 6.12.176.5 ≤ v < 6.13.36.5 ≤ v < 6.146.5 ≤ v < 6.6.806.7 ≤ v < 6.12.17100e16959c3ca8cb7be788ed3e2c5867481f35f66.5
Vendor states this is fixed in 08bd5b7c9a2401faabdaa1472d45c7de0755fd7e (fixed)
Vendor states this is fixed in 3e179d3f1ada963475395d81bfe91daef4d1a24c (fixed)
Vendor states this is fixed in 87da1ea93ec9f9f0004e5b12e78789bc94e360bf (fixed)
Vendor states this is fixed in a2cbcd70133dc0d4d4c95ad4cd5412b935354c7c (fixed)
Vendor states this is fixed in 6.12.17 (unaffected)
Vendor states this is fixed in 6.13.3 (unaffected)
Vendor states this is fixed in 6.14 (unaffected)
Vendor states this is fixed in 6.5 (unaffected)
Vendor states this is fixed in 6.6.80 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/08bd5b7c9a2401faabdaa1472d45c7de0755fd7e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3e179d3f1ada963475395d81bfe91daef4d1a24c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/87da1ea93ec9f9f0004e5b12e78789bc94e360bf
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a2cbcd70133dc0d4d4c95ad4cd5412b935354c7c

CVSS

Attack Vector
LOCAL
Complexity
HIGH
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-367

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card