{"id":"CVE-2025-40071","title":"tty: n_gsm: Don't block input queue by waiting MSC","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: Don't block input queue by waiting MSC\n\nCurrently gsm_queue() processes incoming frames and when opening\na DLC channel it calls gsm_dlci_open() which calls …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < 8fcc22d6b90304d8b7436e101562218ea3faf73b","Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < c36785f9de03df56ff9b8eca30fa681a12b2310d","Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < 5416e89b81b00443cb03c88df8da097ae091a141","Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < c5a2791a7f11939f05f95c01f0aec0c55bbf28d5","Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < 3cf0b3c243e56bc43be560617416c1d9f301f44c","Linux 920e849b7d23ced84c9d11e11e2449e34973cfb8","Linux e83b4e1540469babeffcfd44a605cf8a61542598","Linux >= 5.15.54 < 5.16","Linux >= 5.17.6 < 5.18","Linux 5.18"],"published":"2025-10-28","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:22:47.159Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40071","references":[{"url":"https://git.kernel.org/stable/c/8fcc22d6b90304d8b7436e101562218ea3faf73b"},{"url":"https://git.kernel.org/stable/c/c36785f9de03df56ff9b8eca30fa681a12b2310d"},{"url":"https://git.kernel.org/stable/c/5416e89b81b00443cb03c88df8da097ae091a141"},{"url":"https://git.kernel.org/stable/c/c5a2791a7f11939f05f95c01f0aec0c55bbf28d5"},{"url":"https://git.kernel.org/stable/c/3cf0b3c243e56bc43be560617416c1d9f301f44c"}],"tags":["cve.org"],"epss":0.00201,"epssPercentile":0.10025,"ingestedAt":"2026-11-03T22:57:11.348Z","slug":"CVE-2025-40071","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: Don't block input queue by waiting MSC\n\nCurrently gsm_queue() processes incoming frames and when opening\na DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().\nIf basic mode is used it calls gsm_modem_upd_via_msc() and it\ncannot block the input queue by waiting the response to come\ninto the same input queue.\n\nInstead allow sending Modem Status Command without waiting for remote\nend to respond. Define a new function gsm_modem_send_initial_msc()\nfor this purpose. As MSC is only valid for basic encoding, it does\nnot do anything for advanced or when convergence layer type 2 is used.\n\n## Affected\n\n- `Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < 8fcc22d6b90304d8b7436e101562218ea3faf73b`\n- `Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < c36785f9de03df56ff9b8eca30fa681a12b2310d`\n- `Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < 5416e89b81b00443cb03c88df8da097ae091a141`\n- `Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < c5a2791a7f11939f05f95c01f0aec0c55bbf28d5`\n- `Linux >= 48473802506d2d6151f59e0e764932b33b53cb3b < 3cf0b3c243e56bc43be560617416c1d9f301f44c`\n- `Linux 920e849b7d23ced84c9d11e11e2449e34973cfb8`\n- `Linux e83b4e1540469babeffcfd44a605cf8a61542598`\n- `Linux >= 5.15.54 < 5.16`\n- `Linux >= 5.17.6 < 5.18`\n- `Linux 5.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}