CVE-2025-38736

Root

Cause

The vulnerability resides in the asix_devices driver within the Linux kernel's USB Ethernet subsystem. During MDIO bus initialization, the driver failed to properly mask PHY addresses. Without applying a mask of 0x1f (5 bits, valid range 0-31), invalid or out-of-range PHY addresses could be used. This oversight could trigger a shift-out-of-bounds exception, as demonstrated by a syzbot report [1][2].

Attack

Vector

An attacker with physical access to a USB port could connect a malicious USB device that presents itself as an ASIX-based Ethernet adapter. By supplying crafted descriptors or control requests, the attacker can force the driver to use an invalid PHY address, potentially causing memory corruption or a kernel panic. No network-based authentication is required; the attack surface is limited to local USB access.

Impact

A successful exploitation could lead to an out-of-bounds memory access, resulting in a denial of service (system crash or hang). In some configurations, this might be leveraged for privilege escalation or arbitrary code execution, though the primary risk is system instability. The vulnerability is rated High with a CVSS v3 score of 7.1.

Mitigation

The fix has been integrated into the Linux kernel stable tree and is introduced by commits that add the missing PHY address mask [2][3][4]. Users should apply the latest kernel updates from their distribution vendor. Siemens has also listed this CVE among affected products in advisory SSA-032379, urging updates for SIMATIC CN 4100 devices [1].