CVE-2025-38153: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38153 Overview

CVE-2025-38153 affects the Linux kernel aqc111 USB Ethernet driver. The vulnerability stems from incomplete error handling of USB read call results in aqc111_read_cmd(). When usbnet_read_cmd() returns fewer bytes than requested, the driver fails to detect the short read and proceeds with partially uninitialized data.

Syzkaller, via syzbot, identified the flaw through KMSAN (Kernel Memory Sanitizer) warnings triggered during aqc111_bind(). The MAC address buffer read by aqc111_read_perm_mac() becomes only partly initialized. The uninitialized stack memory then propagates into is_valid_ether_addr() and eth_hw_addr_set(), exposing kernel stack contents to network address handling code paths.

Critical Impact
A local attacker with physical or logical access to attach a malicious USB device can trigger uninitialized kernel memory usage, causing information disclosure or denial of service against the host system.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Debian Linux 11 (bullseye)
Any distribution shipping the aqc111 Aquantia USB Ethernet driver

Discovery Timeline

2025-07-03 - CVE-2025-38153 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38153

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] arising from uninitialized memory use in the drivers/net/usb/aqc111.c source file. The aqc111_read_cmd() helper wraps usbnet_read_cmd(), which may legitimately return a positive value smaller than the requested size parameter. The original implementation checked only for negative error codes, treating short reads as successful.

When aqc111_read_perm_mac() requests six bytes for a MAC address, a short read leaves part of the local buf stack variable uninitialized. The driver then calls ether_addr_copy() to write this partially uninitialized buffer into the network device structure. The tainted data flows through dev_addr_mod() and eventually reaches is_valid_ether_addr() in usbnet_probe(), where KMSAN flags the uninitialized value.

This pattern mirrors the earlier asix driver issue fixed in commit 920a9fa27e78. Beyond triggering sanitizer warnings on instrumented builds, the flaw can leak stack contents into observable network state on production kernels and cause the driver to operate on attacker-influenceable identifiers.

Root Cause

The root cause is missing validation of the return value from usbnet_read_cmd(). USB control transfers can legitimately complete with fewer bytes than requested when a malicious or malfunctioning device responds with a shortened payload. The aqc111 driver treated any non-negative return as a full read, propagating uninitialized stack memory into device state.

Attack Vector

Exploitation requires local access to plug in or emulate a USB device advertising the Aquantia AQC111 identifier. A crafted USB device can respond to control reads with short payloads to keep buffers partially uninitialized. Because the flaw executes during device probe in kernel context, no user authentication beyond hardware attach permissions is needed. Attack surfaces include physical USB ports, USB-over-IP setups, and virtual machines with USB passthrough.

The upstream fix verifies that the actual number of bytes read matches the expected size, returning an error when the counts differ. Refer to the kernel commits referenced in the vendor advisories for the exact patch content.

Detection Methods for CVE-2025-38153

Indicators of Compromise

Kernel log entries showing aqc111 driver probe failures or unexpected MAC addresses on Aquantia USB Ethernet adapters.
KMSAN or KASAN warnings referencing aqc111_bind, aqc111_read_perm_mac, or usbnet_probe on debug-instrumented kernels.
USB device connection events for vendor/product IDs matching AQC111 adapters from unmanaged endpoints.

Detection Strategies

Audit installed kernel versions against the fix commits published on git.kernel.org for the stable trees.
Monitor dmesg and journalctl -k for aqc111 driver messages during USB attach events.
Enable USB device authorization policies (/sys/bus/usb/devices/*/authorized) and log unauthorized attachment attempts.

Monitoring Recommendations

Track USB device insertion events via udev and forward them to a centralized logging platform.
Correlate short-lived network interface creation with USB device attach to identify anomalous probes.
Alert on newly appearing MAC address prefixes on hosts that should not enumerate external USB Ethernet adapters.

How to Mitigate CVE-2025-38153

Immediate Actions Required

Apply the Linux kernel updates from your distribution vendor that include the aqc111 short-read fix.
Debian 11 administrators should install the kernel packages referenced in the Debian LTS security announcements.
Restrict physical USB access on servers, kiosks, and shared workstations to trusted personnel.

Patch Information

The fix is available across multiple stable kernel branches. See the Kernel Git Commit Update 1, Kernel Git Commit Update 2, Kernel Git Commit Update 3, Kernel Git Commit Update 4, Kernel Git Commit Update 5, Kernel Git Commit Update 6, Kernel Git Commit Update 7, and Kernel Git Commit Update 8. Debian users should reference the Debian LTS Security Announcement 1 and Debian LTS Security Announcement 2.

Workarounds

Blacklist the aqc111 module on systems that do not require Aquantia USB Ethernet adapters by adding blacklist aqc111 to /etc/modprobe.d/.
Enforce USBGuard or equivalent policy engines to allow only pre-approved USB device IDs.
Disable USB passthrough on virtual machines and USB-over-IP endpoints that do not require external Ethernet devices.

bash

# Blacklist the aqc111 driver until patched kernel is deployed
echo 'blacklist aqc111' | sudo tee /etc/modprobe.d/blacklist-aqc111.conf
sudo update-initramfs -u
sudo modprobe -r aqc111 2>/dev/null || true