CVE-2025-38086

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A vulnerability in the Linux kernel has been identified, specifically in the ch9200 network driver. The issue arises from the mii nway restart() function, which calls mii->mdio read, also known as ch9200 mdio read(). This function uses a local buffer called buff, initialized by control read(). However, buff is conditionally initialized, and if the condition err == size is not met, buff remains uninitialized. As a result, buff is accessed and returned during ch9200 mdio read(), leading to uninitialized access. The problem is caused by ch9200 mdio read() ignoring the return value of control read(), resulting in uninitialized access of buff.

Recommendations: To fix this issue, check the return value of control read() and return early on error in the ch9200 mdio read() function.