CVE-2025-38149

net: phy: clear phydev->devlink when the link is deleted

published July 3, 2025

CVSS
—
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: phy: clear phydev->devlink when the link is deleted

There is a potential crash issue when disabling and re-enabling the

network port. When disabling the network port, phy_detach() calls

device_link_del() to remove the device link, but it does not clear

phydev->devlink, so phydev->devlink is not a NULL pointer. Then the

network port is re-enabled, but if phy_attach_direct() fails before

calling device_link_add(), the code jumps to the "error" label and

calls phy_detach(). Since phydev->devlink retains the old value from

the previous attach/detach cycle, device_link_del() uses the old value,

which accesses a NULL pointer and causes a crash. The simplified crash

log is as follows.

[ 24.702421] Call trace:

[ 24.704856] device_link_put_kref+0x20/0x120

[ 24.709124] device_link_del+0x30/0x48

[ 24.712864] phy_detach+0x24/0x168

[ 24.716261] phy_attach_direct+0x168/0x3a4

[ 24.720352] phylink_fwnode_phy_connect+0xc8/0x14c

[ 24.725140] phylink_of_phy_connect+0x1c/0x34

Therefore, phydev->devlink needs to be cleared when the device link is

deleted.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.7th percentile
Published
2025-07-03T08:35Z
EPSS history
Timeline
  • 03 JUL 08:35Z
    net: phy: clear phydev->devlink when the link is deleted
    cvelistv5