CVE-2025-71094

net: usb: asix: validate PHY address before use

State: Published
Severity: Not scored
Published: Jan 13, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: asix: validate PHY address before use

The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy():

addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76

Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c.

Scores

The record has no CVSS score.

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before fc96018f09f8d30586ca6582c5045a84eafef146Affected 7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before f5f4f30f3811d37e1aa48667c36add74e5a8d99fAffected 7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before 38722e69ee64dbb020028c93898d25d6f4c0e0b2Affected 7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before 98a12c2547a44a5f03f35c108d2022cc652cbc4dAffected 7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before bf8a0f3b787ca7c5889bfca12c60c483041fbee3Affected 7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before a1e077a3f76eea0dc671ed6792e7d543946227e8Affected 4e4f3cb41d687bd64cd03358862b23c84d82329eAffected 5.13.13 to before 5.14Affected
LinuxLinux	5.14Affected before 5.14Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.4 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before fc96018f09f8d30586ca6582c5045a84eafef146Affected
7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before f5f4f30f3811d37e1aa48667c36add74e5a8d99fAffected
7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before 38722e69ee64dbb020028c93898d25d6f4c0e0b2Affected
7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before 98a12c2547a44a5f03f35c108d2022cc652cbc4dAffected
7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before bf8a0f3b787ca7c5889bfca12c60c483041fbee3Affected
7e88b11a862afe59ee0c365123ea5fb96a26cb3b to before a1e077a3f76eea0dc671ed6792e7d543946227e8Affected
4e4f3cb41d687bd64cd03358862b23c84d82329eAffected
5.13.13 to before 5.14Affected

LinuxLinux

5.14Affected
before 5.14Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.4 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.