CVE-2025-38149

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: phy: clear phydev->devlink when the link is deleted

There is a potential crash issue when disabling and re-enabling the

network port. When disabling the network port, phy_detach() calls

device_link_del() to remove the device link, but it does not clear

phydev->devlink, so phydev->devlink is not a NULL pointer. Then the

network port is re-enabled, but if phy_attach_direct() fails before

calling device_link_add(), the code jumps to the "error" label and

calls phy_detach(). Since phydev->devlink retains the old value from

the previous attach/detach cycle, device_link_del() uses the old value,

which accesses a NULL pointer and causes a crash. The simplified crash

log is as follows.

[ 24.702421] Call trace:

[ 24.704856] device_link_put_kref+0x20/0x120

[ 24.709124] device_link_del+0x30/0x48

[ 24.712864] phy_detach+0x24/0x168

[ 24.716261] phy_attach_direct+0x168/0x3a4

[ 24.720352] phylink_fwnode_phy_c

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References