CVE-2025-38110

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38110", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.985Z", "datePublished": "2025-07-03T08:35:19.928Z", "dateUpdated": "2026-10-15T21:52:08.624Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:37.382Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds clause 45 read/write access\n\nWhen using publicly available tools like 'mdio-tools' to read/write data\nfrom/to network interface and its PHY via C45 (clause 45) mdiobus,\nthere is no verification of parameters passed to the ioctl and\nit accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before C45 read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through SIOCGMIIREG/SIOCSMIIREG ioctls issued on a local socket against a network device, via dev_ioctl() \u2192 dev_eth_ioctl() \u2192 phylink_mii_ioctl(). No network packet processing is involved, so this is local access only.\nAC:L - The attacker fully controls the 16-bit phy_id field and can deterministically select any out-of-bounds index from 32 to 65535, with no race, timing, or memory-layout condition outside their control; the OOB accounting happens on every call regardless of whether the underlying bus read/write succeeds.\nPR:L - The ioctl path is gated by ns_capable(net->user_ns, CAP_NET_ADMIN), which is namespace-relative rather than requiring real root \u2014 an unprivileged user who is root inside a user+network namespace that owns a C45-PHY-backed netdev (SR-IOV VF or DSA user port delegated to a container) satisfies it, so this is Low rather than High.\nUI:N - The attacker triggers the entire sequence themselves with a single ioctl() call; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds access corrupts kernel heap memory from within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - mdiobus_stats_acct() performs a read-modify-write, so it reads 64-bit words at an attacker-chosen offset up to ~2 MB past the mii_bus allocation, and the resulting heap corruption can be groomed to modify length/index fields of adjacent objects to yield arbitrary kernel memory disclosure.\nI:H - The attacker gains a repeatable increment of two 64-bit words at a selectable 32-byte-granular offset far outside the allocation, which after heap grooming allows targeted modification of adjacent kernel objects (refcounts, sizes, pointer bytes) and is a viable path to control-flow hijack.\nA:H - Writing into unrelated slab objects and pages up to ~2 MB beyond the mii_bus allocation corrupts arbitrary kernel state and readily produces oopses, BUG_ONs, or a full panic, and the attacker can repeat it at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/phy/mdio_bus.c"], "versions": [{"version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "lessThan": "abb0605ca00979a49572a6516f6db22c3dc57223", "status": "affected", "versionType": "git"}, {"version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "lessThan": "31bf7b2b92563a352788cf9df3698682f659bacc", "status": "affected", "versionType": "git"}, {"version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "lessThan": "4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7", "status": "affected", "versionType": "git"}, {"version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "lessThan": "260388f79e94fb3026c419a208ece8358bb7b555", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/phy/mdio_bus.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/abb0605ca00979a49572a6516f6db22c3dc57223"}, {"url": "https://git.kernel.org/stable/c/31bf7b2b92563a352788cf9df3698682f659bacc"}, {"url": "https://git.kernel.org/stable/c/4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7"}, {"url": "https://git.kernel.org/stable/c/260388f79e94fb3026c419a208ece8358bb7b555"}], "title": "net/mdiobus: Fix potential out-of-bounds clause 45 read/write access", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:47:30.590466Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:08.624Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:47:30.590466Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:47:31.375Z"}}], "cna": {"title": "net/mdiobus: Fix potential out-of-bounds clause 45 read/write access", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through SIOCGMIIREG/SIOCSMIIREG ioctls issued on a local socket against a network device, via dev_ioctl() \u2192 dev_eth_ioctl() \u2192 phylink_mii_ioctl(). No network packet processing is involved, so this is local access only.\nAC:L - The attacker fully controls the 16-bit phy_id field and can deterministically select any out-of-bounds index from 32 to 65535, with no race, timing, or memory-layout condition outside their control; the OOB accounting happens on every call regardless of whether the underlying bus read/write succeeds.\nPR:L - The ioctl path is gated by ns_capable(net->user_ns, CAP_NET_ADMIN), which is namespace-relative rather than requiring real root \u2014 an unprivileged user who is root inside a user+network namespace that owns a C45-PHY-backed netdev (SR-IOV VF or DSA user port delegated to a container) satisfies it, so this is Low rather than High.\nUI:N - The attacker triggers the entire sequence themselves with a single ioctl() call; no victim action, mount, or file open is needed.\nS:U - The out-of-bounds access corrupts kernel heap memory from within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - mdiobus_stats_acct() performs a read-modify-write, so it reads 64-bit words at an attacker-chosen offset up to ~2 MB past the mii_bus allocation, and the resulting heap corruption can be groomed to modify length/index fields of adjacent objects to yield arbitrary kernel memory disclosure.\nI:H - The attacker gains a repeatable increment of two 64-bit words at a selectable 32-byte-granular offset far outside the allocation, which after heap grooming allows targeted modification of adjacent kernel objects (refcounts, sizes, pointer bytes) and is a viable path to control-flow hijack.\nA:H - Writing into unrelated slab objects and pages up to ~2 MB beyond the mii_bus allocation corrupts arbitrary kernel state and readily produces oopses, BUG_ONs, or a full panic, and the attacker can repeat it at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "lessThan": "abb0605ca00979a49572a6516f6db22c3dc57223", "versionType": "git"}, {"status": "affected", "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "lessThan": "31bf7b2b92563a352788cf9df3698682f659bacc", "versionType": "git"}, {"status": "affected", "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "lessThan": "4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7", "versionType": "git"}, {"status": "affected", "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "lessThan": "260388f79e94fb3026c419a208ece8358bb7b555", "versionType": "git"}], "programFiles": ["drivers/net/phy/mdio_bus.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.94", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.34", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/phy/mdio_bus.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/abb0605ca00979a49572a6516f6db22c3dc57223"}, {"url": "https://git.kernel.org/stable/c/31bf7b2b92563a352788cf9df3698682f659bacc"}, {"url": "https://git.kernel.org/stable/c/4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7"}, {"url": "https://git.kernel.org/stable/c/260388f79e94fb3026c419a208ece8358bb7b555"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds clause 45 read/write access\n\nWhen using publicly available tools like 'mdio-tools' to read/write data\nfrom/to network interface and its PHY via C45 (clause 45) mdiobus,\nthere is no verification of parameters passed to the ioctl and\nit accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before C45 read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.94", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "6.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:37.382Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38110", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:08.624Z", "dateReserved": "2025-04-16T04:51:23.985Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-03T08:35:19.928Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/phy/mdio_bus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "abb0605ca00979a49572a6516f6db22c3dc57223", "status": "affected", "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "versionType": "git"}, {"lessThan": "31bf7b2b92563a352788cf9df3698682f659bacc", "status": "affected", "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "versionType": "git"}, {"lessThan": "4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7", "status": "affected", "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "versionType": "git"}, {"lessThan": "260388f79e94fb3026c419a208ece8358bb7b555", "status": "affected", "version": "4e4aafcddbbfcdd6eed5780e190fcbfac8b4685a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/phy/mdio_bus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.94", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.34", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F32A46D-A3D6-46B7-841B-D6FED06301AA", "versionEndExcluding": "6.6.94", "versionStartIncluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FFA54AA-CDFE-4591-BD07-72813D0948F4", "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds clause 45 read/write access\n\nWhen using publicly available tools like 'mdio-tools' to read/write data\nfrom/to network interface and its PHY via C45 (clause 45) mdiobus,\nthere is no verification of parameters passed to the ioctl and\nit accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before C45 read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mdiobus: Arregla el potencial acceso de lectura/escritura fuera de los l\u00edmites de la cl\u00e1usula 45 Cuando se usan herramientas disponibles p\u00fablicamente como 'mdio-tools' para leer/escribir datos desde/hacia la interfaz de red y su PHY a trav\u00e9s de C45 (cl\u00e1usula 45) mdiobus, no hay verificaci\u00f3n de los par\u00e1metros pasados a ioctl y acepta cualquier direcci\u00f3n mdio. Actualmente hay soporte para 32 direcciones en el kernel a trav\u00e9s de la definici\u00f3n PHY_MAX_ADDR, pero es posible pasar un valor m\u00e1s alto que ese a trav\u00e9s de ioctl. Si bien la operaci\u00f3n de lectura/escritura generalmente deber\u00eda fallar en este caso, mdiobus proporciona una matriz de estad\u00edsticas, donde la direcci\u00f3n incorrecta puede permitir lectura/escritura fuera de los l\u00edmites. Arregla eso agregando la verificaci\u00f3n de direcci\u00f3n antes de la operaci\u00f3n de lectura/escritura C45. Si bien esto excluye este acceso de cualquier estad\u00edstica, mejora la seguridad de la operaci\u00f3n de lectura/escritura."}], "id": "CVE-2025-38110", "lastModified": "2026-10-15T22:18:27.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38110", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:47:30.590466Z", "version": "2.0.3"}}]}, "published": "2025-07-03T09:15:24.680", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/260388f79e94fb3026c419a208ece8358bb7b555"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/31bf7b2b92563a352788cf9df3698682f659bacc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/abb0605ca00979a49572a6516f6db22c3dc57223"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access", "id": "2376035", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376035"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1284", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mdiobus: Fix potential out-of-bounds clause 45 read/write access\nWhen using publicly available tools like 'mdio-tools' to read/write data\nfrom/to network interface and its PHY via C45 (clause 45) mdiobus,\nthere is no verification of parameters passed to the ioctl and\nit accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\nFix that by adding address verification before C45 read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation."], "name": "CVE-2025-38110", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38110\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38110\nhttps://lore.kernel.org/linux-cve-announce/2025070324-CVE-2025-38110-a9c0@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-07-06T22:16:21.897059+00:00", "updated": "2025-07-06T22:16:21.897105+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}