CVE-2025-71196

phy: stm32-usphyc: Fix off by one in probe()

State: Published
Severity: Not scored
Published: Feb 4, 2026
Updated: May 11, 2026
Reserved: Jan 31, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

phy: stm32-usphyc: Fix off by one in probe()

The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	94c358da3a0545205c6c6a50ae26141f1c73acfa to before a9eec890879731c280697fdf1c50699e905b2fa7Affected 94c358da3a0545205c6c6a50ae26141f1c73acfa to before fb9d513cdf1614bf0f0e785816afb1faae3f81afAffected 94c358da3a0545205c6c6a50ae26141f1c73acfa to before c06f13876cbad702582cd67fc77356e5524d02cdAffected 94c358da3a0545205c6c6a50ae26141f1c73acfa to before 76b870fdaad82171a24b8aacffe5e4d9e0d2ee2cAffected 94c358da3a0545205c6c6a50ae26141f1c73acfa to before b91c9f6bfb04e430adeeac7e7ebc9d80f9d72badAffected 94c358da3a0545205c6c6a50ae26141f1c73acfa to before 7c27eaf183563b86d815ff6e9cca0210b4cfa051Affected 94c358da3a0545205c6c6a50ae26141f1c73acfa to before cabd25b57216ddc132efbcc31f972baa03aad15aAffected
LinuxLinux	4.17Affected before 4.17Not affected 5.10.249 through 5.10.Not affected 5.15.199 through 5.15.Not affected 6.1.162 through 6.1.Not affected 6.6.122 through 6.6.Not affected 6.12.67 through 6.12.Not affected 6.18.7 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

94c358da3a0545205c6c6a50ae26141f1c73acfa to before a9eec890879731c280697fdf1c50699e905b2fa7Affected
94c358da3a0545205c6c6a50ae26141f1c73acfa to before fb9d513cdf1614bf0f0e785816afb1faae3f81afAffected
94c358da3a0545205c6c6a50ae26141f1c73acfa to before c06f13876cbad702582cd67fc77356e5524d02cdAffected
94c358da3a0545205c6c6a50ae26141f1c73acfa to before 76b870fdaad82171a24b8aacffe5e4d9e0d2ee2cAffected
94c358da3a0545205c6c6a50ae26141f1c73acfa to before b91c9f6bfb04e430adeeac7e7ebc9d80f9d72badAffected
94c358da3a0545205c6c6a50ae26141f1c73acfa to before 7c27eaf183563b86d815ff6e9cca0210b4cfa051Affected
94c358da3a0545205c6c6a50ae26141f1c73acfa to before cabd25b57216ddc132efbcc31f972baa03aad15aAffected

LinuxLinux

4.17Affected
before 4.17Not affected
5.10.249 through 5.10.*Not affected
5.15.199 through 5.15.*Not affected
6.1.162 through 6.1.*Not affected
6.6.122 through 6.6.*Not affected
6.12.67 through 6.12.*Not affected
6.18.7 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.