CVE-2025-71094 net: usb: asix: validate PHY address before use
A malicious USB device can trigger a kernel warning and potential denial of service by providing an invalid PHY address to the ASIX driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71094?
CVE-2025-71094 is a medium-severity denial of service vulnerability in Linux kernel, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: asix: validate PHY address before use
The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy():
addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76
Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c.
Weakness: CWE-20
Which versions are affected by CVE-2025-71094?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71094?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-71094 being exploited?
There is no known exploitation of CVE-2025-71094 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71094, DEBIAN-CVE-2025-71094, GHSA-fpj9-h5cm-gw64, ROOT-OS-DEBIAN-12-CVE-2025-71094, ROOT-OS-DEBIAN-13-CVE-2025-71094, ROOT-OS-UBUNTU-2204-CVE-2025-71094 and 2 more.