In the Linux kernel, the following vulnerability has been resolved:
net: ch9200: fix uninitialised access during miinwayrestart
In miinwayrestart() the code attempts to call mii->mdioread which is ch9200mdioread(). ch9200mdioread() utilises a local buffer called "buff", which is initialised with controlread(). However "buff" is conditionally initialised inside control_read():
if (err == size) {
memcpy(data, buf, size);
}
If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200mdioread():
return (buff[0] | buff[1] << 8);
The problem stems from the fact that ch9200mdioread() ignores the return value of control_read(), leading to uinit-access of "buff".
To fix this we should check the return value of control_read() and return early on error.
[
{
"digest": {
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
],
"threshold": 0.9
},
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"deprecated": false,
"id": "CVE-2025-38086-1a58dc58",
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33163c68d2e3061fa3935b5f0a1867958b1cdbd2"
},
{
"digest": {
"length": 371.0,
"function_hash": "295347903174713247547193965929899374200"
},
"target": {
"file": "drivers/net/usb/ch9200.c",
"function": "ch9200_mdio_read"
},
"deprecated": false,
"id": "CVE-2025-38086-5b6e4e0d",
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4da7fcc098218ff92b2e83a43f545c02f714cedd"
},
{
"digest": {
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
],
"threshold": 0.9
},
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"deprecated": false,
"id": "CVE-2025-38086-6e47fe7a",
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4da7fcc098218ff92b2e83a43f545c02f714cedd"
},
{
"digest": {
"length": 371.0,
"function_hash": "295347903174713247547193965929899374200"
},
"target": {
"file": "drivers/net/usb/ch9200.c",
"function": "ch9200_mdio_read"
},
"deprecated": false,
"id": "CVE-2025-38086-d4aaf886",
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33163c68d2e3061fa3935b5f0a1867958b1cdbd2"
}
]