Riskcovery

CVE-2025-38537

net: phy: Don't register LEDs for genphy

State
Published
Severity
Not scored
Published
Aug 16, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: phy: Don't register LEDs for genphy

If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock:

rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock()

There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic.

Generic PHYs do not support LEDs anyway, so don't bother registering them.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 01e5b728e9e43ae444e0369695a5f72209906464 to before ec158d05eaa91b2809cab65f8068290e3c05ebddAffected
  • 01e5b728e9e43ae444e0369695a5f72209906464 to before fd6493533af9e5d73d0d42ff2a8ded978a701dc6Affected
  • 01e5b728e9e43ae444e0369695a5f72209906464 to before 75e1b2079ef0653a2f7aa69be515d86b7faf1908Affected
  • 01e5b728e9e43ae444e0369695a5f72209906464 to before f0f2b992d8185a0366be951685e08643aae17d6dAffected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.6.100 through 6.6.*Not affected
  • 6.12.40 through 6.12.*Not affected
  • 6.15.8 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.