In the Linux kernel, the following vulnerability has been resolved:
net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom
Syzbot reported read of uninitialized variable BUG with following call stack.
lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout ===================================================== BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707
Local variable sig.i.i created at: lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766
The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM read timeout errors (-ETIMEDOUT). In the fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error.
As a result, callers could mistakenly treat the data buffer as valid even though the EEPROM read had actually timed out with no data or partial data.
To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM timeout error correctly to the caller.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-gcp-64k-6.17Upgrade linux-image-6.17.0-1011-oemUpgrade linux-image-oracle-64k-6.17Upgrade linux-image-oracleUpgrade linux-image-6.17.0-14-genericUpgrade linux-image-oem-6.17Upgrade linux-image-virtualUpgrade linux-image-6.17.0-1007-gcp-64kUpgrade linux-image-6.17.0-1008-raspiUpgrade linux-image-gcp-6.17Upgrade linux-image-6.17.0-1007-gcpUpgrade linux-image-6.17.0-14-generic-64kUpgrade linux-image-awsUpgrade linux-image-realtimeUpgrade linux-image-6.17.0-1007-awsUpgrade linux-image-6.17.0-1007-oracleUpgrade linux-image-oracle-6.17Upgrade linux-image-6.17.0-1007-aws-64kUpgrade linux-image-gcp-64kUpgrade linux-image-raspi-6.17Upgrade linux-image-generic-6.17Upgrade linux-image-aws-64kUpgrade linux-image-genericUpgrade linux-image-6.17.0-1007-oracle-64kUpgrade linux-image-6.17.0-1008-azureUpgrade linux-image-aws-6.17Upgrade linux-image-aws-64k-6.17Upgrade linux-image-6.17.0-1006-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-raspiUpgrade linux-image-virtual-6.17Upgrade linux-image-oracle-64kUpgrade linux-image-azure-6.17Upgrade linux-image-gcpUpgrade linux-image-azureUpgrade linux-image-generic-64k-6.17Upgrade linux-image-realtime-6.17 | Feb 13, 2026 | Feb 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub