Linux Kernel Vulnerability in CH9200 Network Driver

CVE-2025-38086

What is CVE-2025-38086?

In the Linux kernel, a vulnerability exists within the CH9200 network driver where uninitialized memory access may occur during the execution of the mii_nway_restart() function. The vulnerability arises because the ch9200_mdio_read() function accesses a local buffer named 'buff', which is conditionally initialized. If an error condition occurs, the uninitialized 'buff' is accessed, leading to potential undefined behavior or exploitation. A solution has been implemented to check the return value from control_read() and ensure early termination on errors, mitigating the risk of this vulnerability.

References