PT-2025-36266 · Linux+3 · Linux+3

Syzbot · Published 2025-01-01 · Updated 2026-03-13 · CVE-2025-38736

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions linux (affected versions not specified)

Description The Linux kernel contained a flaw in the USB/ASIX device driver where the PHY address was not properly masked during MDIO bus initialization. This could lead to shift-out-of-bounds exceptions and potential issues with MDIO bus operations due to the use of invalid PHY addresses. The fix involves masking the PHY address with 0x1f to ensure it remains within the valid range of 0-31.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Improper Initialization

Weakness Enumeration

CWE-125

CWE-665

Related Identifiers

BDU:2026-02726

CVE-2025-38736

DLA-4328-1

DSA-6008-1

DSA-6009-1

ECHO-F55A-88E1-5789

OPENSUSE-SU-2025:20081-1

SUSE-SU-2025:03600-1

SUSE-SU-2025:03634-1

SUSE-SU-2025:20851-1

SUSE-SU-2025:20861-1

SUSE-SU-2025:20870-1

SUSE-SU-2025:20898-1

SUSE-SU-2025:21074-1

SUSE-SU-2025:21139-1

SUSE-SU-2025:21179-1

SUSE-SU-2025:3751-1

SUSE-SU-2025:4057-1

SUSE-SU-2025:4132-1

SUSE-SU-2025:4141-1

Affected Products

Astra Linux

Debian

Linux

Suse

References · 2127

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38736.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:21179-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-38736 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38736 · Vendor Advisory
• https://git.kernel.org/stable/c/fcb4ce9f729c1d08e53abf9d449340e24c3edee6 · Patch
• https://git.kernel.org/stable/c/22042ffedd8c2c6db08ccdd6d4273068eddd3c5c · Patch
• https://bdu.fstec.ru/vul/2026-02726 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:20898-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-38736 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-38736 · Vendor Advisory
• https://git.kernel.org/stable/c/748da80831221ae24b4bc8d7ffb22acd5712a341 · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-38736 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38736 · Security Note
• https://git.kernel.org/stable/c/8f141f2a4f2ef8ca865d5921574c3d6535e00a49 · Patch
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory