In the Linux kernel, the following vulnerability has been resolved:
net: ch9200: fix uninitialised access during miinwayrestart
In miinwayrestart() the code attempts to call mii->mdioread which is ch9200mdioread(). ch9200mdioread() utilises a local buffer called "buff", which is initialised with controlread(). However "buff" is conditionally initialised inside control_read():
if (err == size) {
memcpy(data, buf, size);
}
If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200mdioread():
return (buff[0] | buff[1] << 8);
The problem stems from the fact that ch9200mdioread() ignores the return value of control_read(), leading to uinit-access of "buff".
To fix this we should check the return value of control_read() and return early on error.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33163c68d2e3061fa3935b5f0a1867958b1cdbd2",
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-1a58dc58",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd2569d0b2f918e9581f744df0263caf73ee76c",
"target": {
"function": "ch9200_mdio_read",
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-2bc4c6ff",
"signature_type": "Function",
"digest": {
"function_hash": "295347903174713247547193965929899374200",
"length": 371.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a350f30d65197354706b7759b5c89d6c267b1a9",
"target": {
"function": "ch9200_mdio_read",
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-477747a2",
"signature_type": "Function",
"digest": {
"function_hash": "295347903174713247547193965929899374200",
"length": 371.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4da7fcc098218ff92b2e83a43f545c02f714cedd",
"target": {
"function": "ch9200_mdio_read",
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-5b6e4e0d",
"signature_type": "Function",
"digest": {
"function_hash": "295347903174713247547193965929899374200",
"length": 371.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a350f30d65197354706b7759b5c89d6c267b1a9",
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-6b8b6cc2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4da7fcc098218ff92b2e83a43f545c02f714cedd",
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-6e47fe7a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad0452c0277b816a435433cca601304cfac7c21",
"target": {
"function": "ch9200_mdio_read",
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-802f1cc5",
"signature_type": "Function",
"digest": {
"function_hash": "295347903174713247547193965929899374200",
"length": 371.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdaa6d1cb2ff1219c6c822b27655dd170ffb0f72",
"target": {
"function": "ch9200_mdio_read",
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-84425cb7",
"signature_type": "Function",
"digest": {
"function_hash": "295347903174713247547193965929899374200",
"length": 371.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd2569d0b2f918e9581f744df0263caf73ee76c",
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-95837725",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9da3e442714f7f4393ff01c265c4959c03e88c2f",
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-adabd27d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdaa6d1cb2ff1219c6c822b27655dd170ffb0f72",
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-ce4439df",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33163c68d2e3061fa3935b5f0a1867958b1cdbd2",
"target": {
"function": "ch9200_mdio_read",
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-d4aaf886",
"signature_type": "Function",
"digest": {
"function_hash": "295347903174713247547193965929899374200",
"length": 371.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad0452c0277b816a435433cca601304cfac7c21",
"target": {
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-dae4d702",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"330422668284566770639836546828607430452",
"264918695033179464916899967330313124104",
"124740068571631726510015124885522563606",
"200226849685689524791273497988212674380",
"208667703800725683307138867865665487092",
"333335041722352972323157304676535438373",
"330421584743133355356091622465215528070",
"23054688372251863807016885270850794425",
"112985443291291529895546903572716896221"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9da3e442714f7f4393ff01c265c4959c03e88c2f",
"target": {
"function": "ch9200_mdio_read",
"file": "drivers/net/usb/ch9200.c"
},
"id": "CVE-2025-38086-fbbdbfc6",
"signature_type": "Function",
"digest": {
"function_hash": "295347903174713247547193965929899374200",
"length": 371.0
},
"deprecated": false,
"signature_version": "v1"
}
]