CVE-2025-39915

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: phy: transfer phy_config_inband() locking responsibility to phylink

Problem description

===================

Lockdep reports a possible circular locking dependency (AB/BA) between

&pl->state_mutex and &phy->lock, as follows.

phylink_resolve() // acquires &pl->state_mutex

-> phylink_major_config()

-> phy_config_inband() // acquires &pl->phydev->lock

whereas all the other call sites where &pl->state_mutex and

&pl->phydev->lock have the locking scheme reversed. Everywhere else,

&pl->phydev->lock is acquired at the top level, and &pl->state_mutex at

the lower level. A clear example is phylink_bringup_phy().

The outlier is the newly introduced phy_config_inband() and the existing

lock order is the correct one. To understand why it cannot be the other

way around, it is sufficient to consider phylink_phy_change(), phylink's

callback from the PHY device's phy->phy_link_change() virtual method,

invoked by the PHY s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References