CVE-2025-38153

What it actually does

Improper validation of return values from usbnet_read_cmd calls in the aqc111 driver allows fewer bytes than expected to be processed, resulting in partial initialization of the MAC address buffer during aqc111_bind and aqc111_read_perm_mac.

Why it matters to the business

USB Ethernet adapters using the aqc111 chipset may trigger kernel memory safety warnings or undefined behavior on probe, potentially affecting device stability and requiring kernel updates across affected Linux distributions and embedded systems.

How an attack unfolds

An attacker with the ability to attach a malicious or malformed USB device triggers usbnet_probe, which calls into aqc111_bind; incomplete read handling leaves the MAC buffer partially uninitialized, leading to KMSAN-detected uninit-value usage when is_valid_ether_addr is later invoked.

How to fix it

Update the Linux kernel to a version containing commit 8c97655275482ef5384ce0501640630a0fc0f6f4 or later; rebuild and deploy the updated kernel image on all systems using aqc111-based USB adapters. Where distribution packages are available, apply postgresql11-11.17-1.mga8 or postgresql13-13.8-1.mga8 equivalents that incorporate the fix.

How to confirm the fix worked

Confirm the running kernel contains commit 8c97655275482ef5384ce0501640630a0fc0f6f4 by inspecting /proc/version or kernel build logs; attempt to load the aqc111 module with a test device and verify absence of KMSAN uninit-value reports in dmesg.

Typical attack path

1. Attach crafted USB device exposing aqc111 interface
2. Kernel loads usbnet and invokes aqc111_bind during probe
3. aqc111_read_perm_mac issues usb read that returns short data
4. Partial MAC is copied without length check into device address
5. is_valid_ether_addr or later Ethernet stack use encounters uninitialized bytes

How to detect it

Search kernel logs for KMSAN uninit-value reports referencing aqc111_bind, aqc111_read_perm_mac, or is_valid_ether_addr during usbnet_probe; inspect dmesg and audit logs for USB device attach events immediately preceding such warnings.

What your security team should do

• Prioritize kernel updates on systems exposing USB network hardware within the next maintenance window
• Monitor EPSS trend and re-evaluate if exploit maturity increases
• Add kernel memory sanitizer or UBSAN instrumentation to CI test rigs for USB drivers
• Restrict untrusted USB device attachment via policy until patches are deployed