CVE-2025-21689

The CVE concerns Linux kernel USB: serial (quatech2) where qt2_process_read_urb() could dereference NULL due to an out-of-bounds access. The root cause was an incorrect bounds check using if (newport > serial->num_ports) which allowed newport to reach serial->num_ports and make port NULL...