Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability flaw in a Lenovo Yoga Tablet 2 Pro 1380 fast-charger driver. A local low-privileged user could, under specific timing conditions, trigger a kernel NULL pointer dereference and potentially crash the system. The sources do not indicate data theft or remote compromise.
Executive priority
Treat as a targeted availability risk, not an enterprise-wide remote compromise issue. Patch through normal kernel maintenance, escalating only for systems using the affected driver where unexpected reboots would disrupt operations.
Technical view
In yt2_1380_fc_serdev_probe(), the driver opened the serdev device before assigning client operations. If receive_buf runs after SERPORT_ACTIVE is set but before ops is valid, the controller can dereference NULL. The kernel fix sets client ops before opening the serdev port.
Likely exposure
Exposure appears limited to Linux kernels that include and use this platform/x86 Lenovo fast-charger driver on relevant hardware. The CVE lists Linux 6.10, 6.12.11, and 6.13 as affected, but the bundle does not provide distribution-specific package status.
Exploitation context
The CVSS vector is local, high complexity, low privileges, no user interaction, and high availability impact. CISA KEV status is false, and the provided sources do not report active exploitation or public weaponization.
Researcher notes
The issue is a race during serdev initialization leading to CWE-476 NULL pointer dereference. Evidence supports availability impact only. The source bundle lacks proof-of-concept details, exploit telemetry, and distribution-level affected package mapping.
Mitigation direction
- Update to a kernel build containing the referenced stable fixes.
- Check Linux distribution advisories for the exact fixed package version.
- Prioritize affected systems where this driver is present and relevant hardware exists.
- If patching is delayed, follow vendor guidance for reducing driver exposure.
Validation and detection
- Inventory running kernel versions against affected and fixed distribution packages.
- Check whether the Lenovo fast-charger driver is built, installed, or loaded.
- Confirm patched source orders serdev_device_set_client_ops before devm_serdev_device_open.
- Run existing kernel stability and regression tests after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21685 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3f67e07873df3c6d9ce2582260b83732e1d3a40bCVE reference, Linux
- https://git.kernel.org/stable/c/59616a91e5e74833b2008b56c66879857c616006CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.