linux-cve-announce - CVE-2025-71094: net: usb: asix: validate PHY address before use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026011343-CVE-2025-71094-087b@gregkh>
Date: Tue, 13 Jan 2026 16:35:53 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-71094: net: usb: asix: validate PHY address before use

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: usb: asix: validate PHY address before use

The ASIX driver reads the PHY address from the USB device via
asix_read_phy_addr(). A malicious or faulty device can return an
invalid address (>= PHY_MAX_ADDR), which causes a warning in
mdiobus_get_phy():

  addr 207 out of range
  WARNING: drivers/net/phy/mdio_bus.c:76

Validate the PHY address in asix_read_phy_addr() and remove the
now-redundant check in ax88172a.c.

The Linux kernel CVE team has assigned CVE-2025-71094 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit 7e88b11a862afe59ee0c365123ea5fb96a26cb3b and fixed in 6.1.160 with commit f5f4f30f3811d37e1aa48667c36add74e5a8d99f
	Issue introduced in 5.14 with commit 7e88b11a862afe59ee0c365123ea5fb96a26cb3b and fixed in 6.6.120 with commit 38722e69ee64dbb020028c93898d25d6f4c0e0b2
	Issue introduced in 5.14 with commit 7e88b11a862afe59ee0c365123ea5fb96a26cb3b and fixed in 6.12.64 with commit 98a12c2547a44a5f03f35c108d2022cc652cbc4d
	Issue introduced in 5.14 with commit 7e88b11a862afe59ee0c365123ea5fb96a26cb3b and fixed in 6.18.4 with commit bf8a0f3b787ca7c5889bfca12c60c483041fbee3
	Issue introduced in 5.14 with commit 7e88b11a862afe59ee0c365123ea5fb96a26cb3b and fixed in 6.19-rc4 with commit a1e077a3f76eea0dc671ed6792e7d543946227e8
	Issue introduced in 5.13.13 with commit 4e4f3cb41d687bd64cd03358862b23c84d82329e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-71094
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/usb/asix_common.c
	drivers/net/usb/ax88172a.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f5f4f30f3811d37e1aa48667c36add74e5a8d99f
	https://git.kernel.org/stable/c/38722e69ee64dbb020028c93898d25d6f4c0e0b2
	https://git.kernel.org/stable/c/98a12c2547a44a5f03f35c108d2022cc652cbc4d
	https://git.kernel.org/stable/c/bf8a0f3b787ca7c5889bfca12c60c483041fbee3
	https://git.kernel.org/stable/c/a1e077a3f76eea0dc671ed6792e7d543946227e8