CVE-2025-38725 net: usb: asix_devices: add phy_mask for ax88772 mdio bus
A null pointer dereference in the Linux kernel ASIX USB driver can cause a system crash during suspend/resume on specific hardware.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38725?
CVE-2025-38725 is a medium-severity vulnerability in Debian Debian Linux, published on 4 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: asix_devices: add phy_mask for ax88772 mdio bus
Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.
Weakness: CWE-476
Which versions are affected by CVE-2025-38725?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38725?
Apply the vendor's patch.
Is CVE-2025-38725 being exploited?
There is no known exploitation of CVE-2025-38725 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-66890, AZL-73842, BELL-CVE-2025-38725, DEBIAN-CVE-2025-38725, GHSA-cvch-2h28-pxmh, ROOT-OS-DEBIAN-12-CVE-2025-38725 and 3 more.