CVE-2025-38153

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: aqc111: fix error handling of usbnet read calls

Syzkaller, courtesy of syzbot, identified an error (see report [1]) in

aqc111 driver, caused by incomplete sanitation of usb read calls'

results. This problem is quite similar to the one fixed in commit

920a9fa27e78 ("net: asix: add proper error handling of usb read errors").

For instance, usbnet_read_cmd() may read fewer than 'size' bytes,

even if the caller expected the full amount, and aqc111_read_cmd()

will not check its result properly. As [1] shows, this may lead

to MAC address in aqc111_bind() being only partly initialized,

triggering KMSAN warnings.

Fix the issue by verifying that the number of bytes read is

as expected and not less.

[1] Partial syzbot report:

BUG: KMSAN: uninit-value in is_valid_ether_addr include/linux/etherdevice.h:208 [inline]

BUG: KMSAN: uninit-value in usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830

is_valid_ether_ad

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References