In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: fix error handling of usbnet read calls
Syzkaller, courtesy of syzbot, identified an error (see report [1]) in aqc111 driver, caused by incomplete sanitation of usb read calls' results. This problem is quite similar to the one fixed in commit 920a9fa27e78 ("net: asix: add proper error handling of usb read errors").
For instance, usbnetreadcmd() may read fewer than 'size' bytes, even if the caller expected the full amount, and aqc111readcmd() will not check its result properly. As [1] shows, this may lead to MAC address in aqc111_bind() being only partly initialized, triggering KMSAN warnings.
Fix the issue by verifying that the number of bytes read is as expected and not less.
[1] Partial syzbot report: BUG: KMSAN: uninit-value in isvalidetheraddr include/linux/etherdevice.h:208 [inline] BUG: KMSAN: uninit-value in usbnetprobe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 isvalidetheraddr include/linux/etherdevice.h:208 [inline] usbnetprobe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 calldriverprobe drivers/base/dd.c:-1 [inline] reallyprobe+0x4d1/0xd90 drivers/base/dd.c:658 _driverprobedevice+0x268/0x380 drivers/base/dd.c:800 ...
Uninit was stored to memory at: devaddrmod+0xb0/0x550 net/core/devaddrlists.c:582 _devaddrset include/linux/netdevice.h:4874 [inline] ethhwaddrset include/linux/etherdevice.h:325 [inline] aqc111bind+0x35f/0x1150 drivers/net/usb/aqc111.c:717 usbnetprobe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 ...
Uninit was stored to memory at: etheraddrcopy include/linux/etherdevice.h:305 [inline] aqc111readpermmac drivers/net/usb/aqc111.c:663 [inline] aqc111bind+0x794/0x1150 drivers/net/usb/aqc111.c:713 usbnetprobe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772 usbprobeinterface+0xd01/0x1310 drivers/usb/core/driver.c:396 calldriver_probe drivers/base/dd.c:-1 [inline] ...
Local variable buf.i created at: aqc111readpermmac drivers/net/usb/aqc111.c:656 [inline] aqc111bind+0x221/0x1150 drivers/net/usb/aqc111.c:713 usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772
[
{
"digest": {
"line_hashes": [
"195979657853315089955161862307306030",
"293209705601342738225698368168739551124",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"237662156987096869146965269570264822995",
"143292050674642873018982154929183391259",
"60717427552387382518985613932150853607",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"200033022058658829598722152758568840598"
],
"threshold": 0.9
},
"id": "CVE-2025-38153-0a4fc3eb",
"target": {
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c01863b1c47f040d9674171e77789a423b9b128",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"195979657853315089955161862307306030",
"293209705601342738225698368168739551124",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"237662156987096869146965269570264822995",
"143292050674642873018982154929183391259",
"60717427552387382518985613932150853607",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"200033022058658829598722152758568840598"
],
"threshold": 0.9
},
"id": "CVE-2025-38153-25c85d81",
"target": {
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30a9e834c74e260533b8d0885e3c89f6f32f7993",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-2c65c2b2",
"target": {
"function": "aqc111_read_cmd",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c01863b1c47f040d9674171e77789a423b9b128",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"195979657853315089955161862307306030",
"293209705601342738225698368168739551124",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"237662156987096869146965269570264822995",
"143292050674642873018982154929183391259",
"60717427552387382518985613932150853607",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"200033022058658829598722152758568840598"
],
"threshold": 0.9
},
"id": "CVE-2025-38153-2e4566f3",
"target": {
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@405b0d610745fb5e84fc2961d9b960abb9f3d107",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"195979657853315089955161862307306030",
"293209705601342738225698368168739551124",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"237662156987096869146965269570264822995",
"143292050674642873018982154929183391259",
"60717427552387382518985613932150853607",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"200033022058658829598722152758568840598"
],
"threshold": 0.9
},
"id": "CVE-2025-38153-504e3be9",
"target": {
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11273279012c922f37cfb4dd95d142803fc07b98",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"195979657853315089955161862307306030",
"293209705601342738225698368168739551124",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"237662156987096869146965269570264822995",
"143292050674642873018982154929183391259",
"60717427552387382518985613932150853607",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"200033022058658829598722152758568840598"
],
"threshold": 0.9
},
"id": "CVE-2025-38153-60ce7f18",
"target": {
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f398d2dfe450ce2c031d10b585448862d74a0501",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-66a13a77",
"target": {
"function": "aqc111_read_cmd",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f398d2dfe450ce2c031d10b585448862d74a0501",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"195979657853315089955161862307306030",
"293209705601342738225698368168739551124",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"237662156987096869146965269570264822995",
"143292050674642873018982154929183391259",
"60717427552387382518985613932150853607",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"200033022058658829598722152758568840598"
],
"threshold": 0.9
},
"id": "CVE-2025-38153-6968113e",
"target": {
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c97655275482ef5384ce0501640630a0fc0f6f4",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-80a702cb",
"target": {
"function": "aqc111_read_cmd_nopm",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c01863b1c47f040d9674171e77789a423b9b128",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-83c312d1",
"target": {
"function": "aqc111_read_cmd_nopm",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c97655275482ef5384ce0501640630a0fc0f6f4",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-8549b44e",
"target": {
"function": "aqc111_read_cmd_nopm",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11273279012c922f37cfb4dd95d142803fc07b98",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-8babad9b",
"target": {
"function": "aqc111_read_cmd",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30a9e834c74e260533b8d0885e3c89f6f32f7993",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-93802257",
"target": {
"function": "aqc111_read_cmd",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c97655275482ef5384ce0501640630a0fc0f6f4",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"195979657853315089955161862307306030",
"293209705601342738225698368168739551124",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"237662156987096869146965269570264822995",
"143292050674642873018982154929183391259",
"60717427552387382518985613932150853607",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"200033022058658829598722152758568840598"
],
"threshold": 0.9
},
"id": "CVE-2025-38153-96f63d1e",
"target": {
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acb47a40b5e38be03ef659b7bacdddc592ed73b7",
"signature_type": "Line"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-a0977b94",
"target": {
"function": "aqc111_read_cmd",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60790d287c1a1ced3554d4a87c2f27bf299a932a",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-a8a497c1",
"target": {
"function": "aqc111_read_cmd_nopm",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@405b0d610745fb5e84fc2961d9b960abb9f3d107",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-c5b8a978",
"target": {
"function": "aqc111_read_cmd_nopm",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30a9e834c74e260533b8d0885e3c89f6f32f7993",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-d45ff54c",
"target": {
"function": "aqc111_read_cmd_nopm",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f398d2dfe450ce2c031d10b585448862d74a0501",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-d83ea51b",
"target": {
"function": "aqc111_read_cmd_nopm",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acb47a40b5e38be03ef659b7bacdddc592ed73b7",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-dff1bfd0",
"target": {
"function": "aqc111_read_cmd",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11273279012c922f37cfb4dd95d142803fc07b98",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-e52a1ac5",
"target": {
"function": "aqc111_read_cmd_nopm",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60790d287c1a1ced3554d4a87c2f27bf299a932a",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-f6138245",
"target": {
"function": "aqc111_read_cmd",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@405b0d610745fb5e84fc2961d9b960abb9f3d107",
"signature_type": "Function"
},
{
"digest": {
"function_hash": "155398492600023309862081779368123850584",
"length": 383.0
},
"id": "CVE-2025-38153-f82d2d7e",
"target": {
"function": "aqc111_read_cmd",
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acb47a40b5e38be03ef659b7bacdddc592ed73b7",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"195979657853315089955161862307306030",
"293209705601342738225698368168739551124",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"237662156987096869146965269570264822995",
"143292050674642873018982154929183391259",
"60717427552387382518985613932150853607",
"338962302061643813659950881627949144441",
"64252891331933517291836906214608836870",
"155153774635472410668695416023008897957",
"5802046777772661941747739379186905605",
"200033022058658829598722152758568840598"
],
"threshold": 0.9
},
"id": "CVE-2025-38153-feb6b720",
"target": {
"file": "drivers/net/usb/aqc111.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60790d287c1a1ced3554d4a87c2f27bf299a932a",
"signature_type": "Line"
}
]