CVE-2025-38153 in Linux
Summary
by MITRE • 07/03/2025
In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: fix error handling of usbnet read calls
Syzkaller, courtesy of syzbot, identified an error (see report [1]) in
aqc111 driver, caused by incomplete sanitation of usb read calls' results. This problem is quite similar to the one fixed in commit 920a9fa27e78 ("net: asix: add proper error handling of usb read errors").
For instance, usbnet_read_cmd() may read fewer than 'size' bytes, even if the caller expected the full amount, and aqc111_read_cmd() will not check its result properly. As [1] shows, this may lead
to MAC address in aqc111_bind() being only partly initialized, triggering KMSAN warnings.
Fix the issue by verifying that the number of bytes read is as expected and not less.
[1] Partial syzbot report:
BUG: KMSAN: uninit-value in is_valid_ether_addr include/linux/etherdevice.h:208 [inline]
BUG: KMSAN: uninit-value in usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 is_valid_ether_addr include/linux/etherdevice.h:208 [inline]
usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x4d1/0xd90 drivers/base/dd.c:658 __driver_probe_device+0x268/0x380 drivers/base/dd.c:800 ...
Uninit was stored to memory at: dev_addr_mod+0xb0/0x550 net/core/dev_addr_lists.c:582 __dev_addr_set include/linux/netdevice.h:4874 [inline]
eth_hw_addr_set include/linux/etherdevice.h:325 [inline]
aqc111_bind+0x35f/0x1150 drivers/net/usb/aqc111.c:717 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 ...
Uninit was stored to memory at: ether_addr_copy include/linux/etherdevice.h:305 [inline]
aqc111_read_perm_mac drivers/net/usb/aqc111.c:663 [inline]
aqc111_bind+0x794/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline]
...
Local variable buf.i created at: aqc111_read_perm_mac drivers/net/usb/aqc111.c:656 [inline]
aqc111_bind+0x221/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/18/2026
The vulnerability CVE-2025-38153 affects the Linux kernel's USB networking driver, specifically the aqc111 driver used for certain USB Ethernet adapters. This issue arises from improper error handling during USB read operations, which can lead to uninitialized memory being used in critical network operations. The problem was identified through automated testing using syzbot, a system that detects kernel bugs through fuzzing, and bears strong resemblance to a previously fixed issue in the asix driver, indicating a pattern of similar implementation flaws across USB network drivers.
The core technical flaw involves the aqc111_read_cmd() function which does not properly validate the number of bytes actually read from USB devices during communication. The usbnet_read_cmd() function can return fewer bytes than requested even when the USB transfer appears successful, but the aqc111 driver fails to verify this condition. This incomplete validation leads to situations where only partial data is read into buffers, causing uninitialized memory contents to be processed as valid MAC addresses. The vulnerability manifests when the aqc111_bind() function attempts to initialize the device's MAC address using these incomplete reads, resulting in the use of uninitialized memory values that trigger KMSAN (Kernel Memory Sanitizer) warnings.
The operational impact of this vulnerability extends beyond simple memory corruption, as it can affect network connectivity and potentially create security implications through malformed MAC address handling. When the driver fails to properly initialize the MAC address due to incomplete USB reads, it may result in unpredictable network behavior, connection failures, or even create opportunities for network-level attacks that exploit the inconsistent device state. The issue demonstrates a fundamental flaw in USB device communication handling where drivers assume successful transfers will always return complete data, ignoring the possibility of partial reads that are common in USB communication scenarios.
Mitigation of this vulnerability requires implementing proper error checking in the aqc111 driver's USB read operations, specifically ensuring that the number of bytes actually read matches the expected amount before proceeding with data processing. The fix involves adding validation checks that verify the return value of USB read operations and handle cases where fewer bytes are returned than expected. This approach aligns with common security practices for USB device drivers and follows the established pattern used in similar fixes within the Linux kernel ecosystem, particularly the precedent set by the asix driver fix referenced in the commit. The solution directly addresses the root cause by ensuring that network device initialization only proceeds when complete data has been successfully read from the USB device, preventing the use of uninitialized memory in critical network operations.
This vulnerability type maps to CWE-457: Use of Uninitialized Variable and CWE-248: Uncaught Exception, both of which are commonly exploited in kernel-level attacks. From an ATT&CK perspective, this issue could enable initial access through network device manipulation or potentially serve as a stepping stone for privilege escalation if exploited in a kernel context. The vulnerability highlights the importance of proper error handling in kernel drivers and demonstrates how seemingly minor issues in USB communication can have significant security implications for network infrastructure components.