CVE-2025-39905 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver
A race condition in the Linux kernel's phylink subsystem can lead to system instability or denial of service due to unsynchronized access to phydev pointers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39905?
CVE-2025-39905 is a high-severity vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: phylink: add lock for serializing concurrent pl->phydev writes with resolver
Currently phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_phy() calls which modify pl->phydev by relying on pl->state_mutex.
The problem is that in phylink_resolve(), pl->state_mutex is in a lock inversion state with pl->phydev->lock. So pl->phydev->lock needs to be acquired prior to pl->state_mutex. But that requires dereferencing pl->phydev in the first place, and without pl->state_mutex, that is racy.
Hence the reason for the extra lock. Currently it is redundant, but it will serve a functional purpose once mutex_lock(&phy->lock) will be moved outside of the mutex_lock(&pl->state_mutex) section.
Another alternative considered would have been to let phylink_resolve() acquire the rtnl_mutex, which is also held when phylink_bringup_phy() and phylink_disconnect_phy() are called. But since phylink_disconnect_phy() runs under rtnl_lock(), it would deadlock with phylink_resolve() when calling flush_work(&pl->resolve). Additionally, it would have been undesirable because it would have unnecessarily blocked many other call paths as well in the entire kernel, so the smaller-scoped lock was preferred.
Weakness: CWE-362
Which versions are affected by CVE-2025-39905?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39905?
Apply the vendor's patch.
Is CVE-2025-39905 being exploited?
There is no known exploitation of CVE-2025-39905 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-68040, AZL-72358, BELL-CVE-2025-39905, DEBIAN-CVE-2025-39905, GHSA-3w4m-c8rq-62jj, ROOT-OS-DEBIAN-11-CVE-2025-39905 and 5 more.