FlawAtlas
Search the atlas
CVE-2025-38736 Not scored

net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.

Exploit probability 0.2%
Published September 5, 2025
Required by Not available
Last source change July 16, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

880 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2025:20081-1
related SUSE-SU-2025:03600-1
related SUSE-SU-2025:03634-1
related SUSE-SU-2025:20851-1
related SUSE-SU-2025:20861-1
related SUSE-SU-2025:20870-1
related SUSE-SU-2025:20898-1
related SUSE-SU-2025:21074-1
related SUSE-SU-2025:21139-1
related SUSE-SU-2025:21179-1
related SUSE-SU-2025:3751-1
related SUSE-SU-2025:4057-1
related SUSE-SU-2025:4132-1
related SUSE-SU-2025:4141-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-38736

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.

View original source

05 / REFERENCES

Further evidence