CVE-2025-38086: net: ch9200: fix uninitialised access during mii_nway_restart
In the Linux kernel, the following vulnerability has been resolved:
net: ch9200: fix uninitialised access during miinwayrestart
In miinwayrestart() the code attempts to call mii->mdioread which is ch9200mdioread(). ch9200mdioread() utilises a local buffer called "buff", which is initialised with controlread(). However "buff" is conditionally initialised inside controlread():
if (err == size) { memcpy(data, buf, size); }
If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200mdioread():
return (buff[0] | buff[1] << 8);
The problem stems from the fact that ch9200mdioread() ignores the return value of controlread(), leading to uinit-access of "buff".
To fix this we should check the return value of controlread() and return early on error.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: ch9200: fix uninitialised access during miinwayrestart
In miinwayrestart() the code attempts to call mii->mdioread which is ch9200mdioread(). ch9200mdioread() utilises a local buffer called "buff", which is initialised with controlread(). However "buff" is conditionally initialised inside controlread():
if (err == size) { memcpy(data, buf, size); }
If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200mdioread():
return (buff[0] | buff[1] << 8);
The problem stems from the fact that ch9200mdioread() ignores the return value of controlread(), leading to uinit-access of "buff".
To fix this we should check the return value of controlread() and return early on error.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In mii_nway_restart(), check the return value of control_read(); if the call fails (e.g., the condition err == size is not met), return early instead of proceeding to use the local buffer 'buff', preventing uninitialised access during mii_nway_restart().
Linux kernel (net: ch9200) mii_nway_restart() control_read() return-value handling = return early on error (check ch9200_mdio_read() / control_read() return value)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38086?
CVE-2025-38086 is classified as a medium severity vulnerability due to the potential for uninitialized memory access.
What does CVE-2025-38086 affect?
CVE-2025-38086 specifically affects the Linux kernel and is related to the ch9200 network driver.
How do I fix CVE-2025-38086?
To fix CVE-2025-38086, you should update your Linux kernel to the latest stable version provided by your distribution.
Is CVE-2025-38086 a local or remote vulnerability?
CVE-2025-38086 is considered a local vulnerability as it requires local access to exploit.
When was CVE-2025-38086 published?
CVE-2025-38086 was published as part of the ongoing security updates for the Linux kernel.