CVE-2017-8925 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8925): The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling. CVE-2017-8924 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8924): The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.
Fixes in 4.9.16, 4.11