CVE-2025-38725

MEDIUM

Linux Kernel 5.14-6.16.2 - Null Pointer Dereference in ax88772 MDIO Bus

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.

Scores

CVSS v3 5.5
EPSS 0.0002
EPSS Percentile 6.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-476
Status published
Products (25)
debian/debian_linux 11.0
linux/Kernel 5.14.0 - 5.15.190linux
linux/Kernel 5.16.0 - 6.1.149linux
linux/Kernel 6.13.0 - 6.15.11linux
linux/Kernel 6.16.0 - 6.16.2linux
linux/Kernel 6.2.0 - 6.6.103linux
linux/Kernel 6.7.0 - 6.12.43linux
Linux/Linux < 5.14
Linux/Linux 5.14
Linux/Linux 5.15.190 - 5.15.*
... and 15 more
Published Sep 04, 2025
Tracked Since Feb 18, 2026