Uninitialized Buffer Access in Linux Kernel's CH9200 Driver
Summary
CVE-2025-38086: In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read()... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It manages hardware resources and provides essential services for software applications. The CH9200 driver is responsible for handling specific hardware components, particularly in network interfaces. This driver is crucial for ensuring proper communication between the operating system and the hardware. However, it is susceptible to vulnerabilities that can lead to uninitialized memory access, potentially compromising system stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-38086 arises from an uninitialized access in the CH9200 driver during the execution of the mii_nway_restart() function. Specifically, the function attempts to read from a local buffer named 'buff' that is initialized conditionally within the control_read() function. If the condition for initialization is not met, 'buff' remains uninitialized, leading to undefined behavior when accessed in the ch9200_mdio_read() function. This oversight can result in data corruption, system crashes, or exploitation by malicious actors, making it a critical issue that needs addressing.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than applying the patch. Users are advised to monitor their systems and apply updates as soon as they become available.
Conclusion
CVE-2025-38086 represents a significant vulnerability in the Linux kernel's CH9200 driver, stemming from uninitialized memory access. Users are strongly encouraged to update their systems to the latest patched version to ensure security and stability. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38086 is a vulnerability in the Linux kernel's CH9200 driver that involves uninitialized memory access, which can lead to system instability and security risks.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by this vulnerability. Visit Vulert Scanner to use the Vulert playground without any signup.
The uninitialized access can lead to data corruption, system crashes, or exploitation by attackers, posing significant risks to system security and reliability.
Yes, a patch has been released for the Linux kernel to address CVE-2025-38086. Users should update their systems to the latest version to apply the fix.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and apply the update as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
