cve 2025 38153

CVE-2025-38153 is a vulnerability in the AQC111 USB Ethernet driver for Linux. The flaw stems from a missing validation of the byte count returned by usbnet read calls, which could lead to incorrect behavior in systems using the aqc111 driver. Microsoft has acknowledged that Azure Linux includes the affected open-source library and is potentially impacted, but this does not guarantee that other Microsoft products are free from the vulnerable code. The distinction between attestation of impact and exclusivity of impact is critical for understanding the scope of this CVE. Discussions on WindowsForum highlight the operational implications and the upstream Linux kernel fix for this correctness bug.