Critical Crash Vulnerability in Linux Kernel Package: linux - Device Link Management Issue
Summary
DEBIAN-CVE-2025-38149: In the Linux kernel, the following vulnerability has been resolved: net: phy: clear phydev->devlink when the link is deleted There is a potential crash issue when disabling and re-enabling the network port. Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for enabling the operating system to communicate with hardware components, ensuring efficient operation and resource management. The kernel is crucial for system stability and performance, making its security paramount. This specific vulnerability affects the management of device links within the network subsystem, potentially leading to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of device links when disabling and re-enabling network ports. The issue arises during the phy_detach() function, which fails to clear the phydev->devlink pointer when the device link is removed. As a result, if the network port is re-enabled and the phy_attach_direct() function fails, the system attempts to access a NULL pointer during the cleanup process, leading to a crash. This vulnerability can cause significant disruptions in network functionality and overall system stability.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate the risk of crashes.
Conclusion
The identified vulnerability in the Linux kernel package poses a significant risk of system crashes due to improper handling of device links. It is essential for users to update their systems to the latest patched version to ensure stability and security. Regular monitoring and prompt updates are key to maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of device links in the Linux kernel, which can lead to system crashes when network ports are disabled and re-enabled.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can cause crashes in the network subsystem, leading to disruptions in network connectivity and overall system instability.
Yes, a patch has been released in version 6.12.35-1 of the linux package. It is recommended to update to this version or later.
While no specific workarounds are provided, it is crucial to monitor your system closely and apply the patch as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
