PT-2025-27697 · Linux+6 · Linux Kernel+6
Published
2025-07-03
·
Updated
2026-04-20
·
CVE-2025-38111
CVSS v2.0
7.7
High
| Vector | AV:A/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
A potential out-of-bounds read/write access issue has been identified in the Linux kernel. The issue occurs when using tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus. The problem arises because there is no verification of parameters passed to the ioctl, allowing any mdio address to be accepted. Although the kernel currently supports 32 addresses via the PHY MAX ADDR define, it is possible to pass higher values via ioctl. This could lead to out-of-bounds read/write access in the stats array, even though read/write operations should generally fail in such cases. The issue has been fixed by adding address verification before read/write operations, improving the security of these operations.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Corruption
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu