PT-2025-35999 · Linux +1 · Linux Kernel +1

Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-38726

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions:

Linux kernel (affected versions not specified)

Description:

The Linux kernel contains a flaw in the `ftgmac100 phy disconnect` function within the `ftgmac100` module. A potential NULL pointer access could occur because `netdev->phydev` is reset to NULL after calling `phy disconnect()`, leading to `fixed phy unregister()` being called with a NULL pointer argument. The issue is resolved by caching the `phy device` before the call to `phy disconnect()`.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-38726

Affected Products

Linux Kernel

Ftgmac100

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-38726 · Security Note
• https://git.kernel.org/stable/c/9ad90dd34b4e8e5be1e45a4559f4de0f14e53af2 · Note
• https://git.kernel.org/stable/c/ae59ec969c07c73f0610f8bd7e648f01e798d222 · Note
• https://git.kernel.org/stable/c/44bcd397ad9cd1a6b25fabb7f5edbee4fb0cfc2e · Note
• https://git.kernel.org/stable/c/e88fbc30dda1cb7438515303704ceddb3ade4ecd · Note
• https://twitter.com/CVEnew/status/1963637902644318294 · Twitter Post