{"id":"CVE-2025-38736","revision":"78ad0042921a46f896702274000d1092","records":[{"revision":"78ad0042921a46f896702274000d1092","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38736","aliases":[],"title":"net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: asix_devices: Fix PHY address mask in MDIO bus initialization\n\nSyzbot reported shift-out-of-bounds exception on MDIO bus initialization.\n\nThe PHY address should be masked to 5 bits (0-31). Without this\nmask, invalid PHY addresses could be used, potentially causing issues\nwith MDIO bus operations.\n\nFix this by masking the PHY address with 0x1f (31 decimal) to ensure\nit stays within the valid range.","state":0,"publishedAt":"2025-09-05T17:20:36.546+00:00","modifiedAt":"2026-10-15T01:07:56.195+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/usb/asix_devices.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"75947d3200de98a9ded9ad8972e02f1a177097fe\",\n                            \"lessThan\": \"fcb4ce9f729c1d08e53abf9d449340e24c3edee6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"59ed6fbdb1bc03316e09493ffde7066f031c7524\",\n                            \"lessThan\": \"8f141f2a4f2ef8ca865d5921574c3d6535e00a49\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ccef5ee4adf56472aa26bdd1f821a6d0cd06089a\",\n                            \"lessThan\": \"748da80831221ae24b4bc8d7ffb22acd5712a341\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee2cd40b0bb46056949a2319084a729d95389386\",\n                            \"lessThan\": \"22042ffedd8c2c6db08ccdd6d4273068eddd3c5c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ad1f8313aeec0115f9978bd2d002ef4a8d96c773\",\n                            \"lessThan\": \"523eab02fce458fa6d3c51de5bb055800986953e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4faff70959d51078f9ee8372f8cff0d7045e4114\",\n                            \"lessThan\": \"24ef2f53c07f273bad99173e27ee88d44d135b1c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a754ab53993b1585132e871c5d811167ad3c52ff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.15.11\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/usb/asix_devices.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.12.43\",\n                            \"lessThan\": \"6.12.44\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.2\",\n                            \"lessThan\": \"6.16.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/fcb4ce9f729c1d08e53abf9d449340e24c3edee6","https://git.kernel.org/stable/c/8f141f2a4f2ef8ca865d5921574c3d6535e00a49","https://git.kernel.org/stable/c/748da80831221ae24b4bc8d7ffb22acd5712a341","https://git.kernel.org/stable/c/22042ffedd8c2c6db08ccdd6d4273068eddd3c5c","https://git.kernel.org/stable/c/523eab02fce458fa6d3c51de5bb055800986953e","https://git.kernel.org/stable/c/24ef2f53c07f273bad99173e27ee88d44d135b1c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38736","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38736","identifiers":["CVE-2025-38736"]},"retained":false,"historicalAffected":[]}],"coverage":[]}