PT-2025-40089 · Linux+1 · Linux Kernel+1
Published
2025-09-04
·
Updated
2025-10-01
·
CVE-2025-39915
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a potential deadlock risk within the networking subsystem related to the handling of PHY device configuration. Specifically, a circular locking dependency exists between
&pl->state mutex and &phy->lock during the phylink resolve() and phy config inband() functions. This occurs because phylink resolve() acquires &pl->state mutex, which then calls phylink major config(), which in turn acquires &phy->lock. This is inconsistent with the typical locking order where &phy->lock is acquired before &pl->state mutex. The issue could potentially lead to a deadlock if phylink resolve() is concurrent with phy link up() or phy link down(), which acquire &phydev->lock before &pl->state mutex. The problem was discovered using lockdep. The call graph involves functions such as phylink start(), phylink mac initial config(), phylink resolve(), phylink major config(), and phy config inband().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linux Kernel