CVE-2025-38736 net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
A missing mask in the Linux kernel ASIX USB driver allows invalid PHY addresses, causing a shift-out-of-bounds exception and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38736?
CVE-2025-38736 is a high-severity vulnerability in Debian Debian Linux, published on 5 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.
The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations.
Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.
Weakness: CWE-125
Which versions are affected by CVE-2025-38736?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38736?
Apply the vendor's patch.
Is CVE-2025-38736 being exploited?
There is no known exploitation of CVE-2025-38736 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-38736, DEBIAN-CVE-2025-38736, GHSA-9pqv-7h63-32cr, ROOT-OS-DEBIAN-12-CVE-2025-38736, ROOT-OS-DEBIAN-13-CVE-2025-38736, UBUNTU-CVE-2025-38736.