Critical Vulnerability in Linux Kernel: MDIO Bus PM Operations Issue
Summary
CVE-2025-37945: In the Linux kernel, the following vulnerability has been resolved: net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY DSA has 2 kinds of drivers: 1. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of hardware devices and is crucial for system performance and stability. This vulnerability specifically affects the MDIO bus power management operations within the kernel, which are vital for managing PHY devices in network interfaces.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the MDIO bus power management operations for PHY devices controlled by phylink. The issue arises when certain DSA drivers do not manage power states correctly, leading to warnings and potential instability. Specifically, the PHY state machine may not stop as expected during suspend operations, resulting in the PHY being in an incorrect state when resumed. This can lead to system crashes or degraded network performance, especially for drivers that do not implement MAC managed power management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that the PHY device has the phydev->phy_link_change() implementation set to the default provided by phylib. This can help mitigate the issue until a proper fix is applied.
Conclusion
The identified vulnerability in the Linux kernel regarding MDIO bus power management operations poses significant risks to system stability and network performance. It is crucial for users to update their systems to the patched version to mitigate these risks effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of power management operations for PHY devices in the Linux kernel, which can lead to system instability.
The vulnerability affects various versions of the Linux kernel, particularly those that do not implement MAC managed power management for certain DSA drivers.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to system crashes, degraded network performance, and instability in applications relying on affected drivers.
Yes, the permanent fix is to update the Linux kernel to the patched version, specifically 6.12.25-1 or later for Debian 13.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
