CVE-2025-38153: net: usb: aqc111: fix error handling of usbnet read calls
In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: fix error handling of usbnet read calls
Syzkaller, courtesy of syzbot, identified an error (see report [1]) in aqc111 driver, caused by incomplete sanitation of usb read calls' results. This problem is quite similar to the one fixed in commit 920a9fa27e78 ("net: asix: add proper error handling of usb read errors").
For instance, usbnetreadcmd() may read fewer than 'size' bytes, even if the caller expected the full amount, and aqc111readcmd() will not check its result properly. As [1] shows, this may lead to MAC address in aqc111bind() being only partly initialized, triggering KMSAN warnings.
Fix the issue by verifying that the number of bytes read is as expected and not less.
[1] Partial syzbot report: BUG: KMSAN: uninit-value in isvalidetheraddr include/linux/etherdevice.h:208 [inline] BUG: KMSAN: uninit-value in usbnetprobe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 isvalidetheraddr include/linux/etherdevice.h:208 [inline] usbnetprobe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 calldriverprobe drivers/base/dd.c:-1 [inline] reallyprobe+0x4d1/0xd90 drivers/base/dd.c:658 driverprobedevice+0x268/0x380 drivers/base/dd.c:800 ...
Uninit was stored to memory at: devaddrmod+0xb0/0x550 net/core/devaddrlists.c:582 devaddrset include/linux/netdevice.h:4874 [inline] ethhwaddrset include/linux/etherdevice.h:325 [inline] aqc111bind+0x35f/0x1150 drivers/net/usb/aqc111.c:717 usbnetprobe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 ...
Uninit was stored to memory at: etheraddrcopy include/linux/etherdevice.h:305 [inline] aqc111readpermmac drivers/net/usb/aqc111.c:663 [inline] aqc111bind+0x794/0x1150 drivers/net/usb/aqc111.c:713 usbnetprobe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 calldriverprobe drivers/base/dd.c:-1 [inline] ...
Local variable buf.i created at: aqc111readpermmac drivers/net/usb/aqc111.c:656 [inline] aqc111bind+0x221/0x1150 drivers/net/usb/aqc111.c:713 usbnetprobe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Modify the Linux kernel net/usb/aqc111 driver so usbnet_read_cmd() results are verified to contain the expected number of bytes, rejecting reads shorter than the requested size before aqc111_read_cmd() uses the data.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38153?
The severity of CVE-2025-38153 is classified as moderate, due to potential denial-of-service risks.
How do I fix CVE-2025-38153?
To mitigate CVE-2025-38153, users should update their Linux kernel to the latest version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-38153?
CVE-2025-38153 affects multiple versions of the Linux kernel that include the aqc111 driver prior to the fix.
What type of vulnerability is CVE-2025-38153?
CVE-2025-38153 is a driver error handling vulnerability specifically related to usbnet read calls in the Linux kernel.
Who discovered CVE-2025-38153?
CVE-2025-38153 was identified by Syzkaller, through the efforts of the syzbot testing service.