PT-2025-27696 · Linux+8 · Linux Kernel+8
Publicado
2025-06-09
·
Atualizado
2026-04-20
·
CVE-2025-38110
CVSS v3.1
7.1
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
A potential out-of-bounds read/write access issue has been identified in the Linux kernel, specifically in the
net/mdiobus component. This issue arises when using tools like mdio-tools to read or write data from/to a network interface and its PHY via C45 (clause 45) mdiobus. The problem occurs because there is no verification of parameters passed to the ioctl, allowing any mdio address to be accepted. Although the kernel currently supports 32 addresses via the PHY MAX ADDR define, it is possible to pass higher values via ioctl, potentially leading to out-of-bounds read/write access. The issue has been fixed by adding address verification before C45 read/write operations, improving the security of these operations.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Out of bounds Read
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Almalinux
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu