In the Linux kernel, the following vulnerability has been resolved:
net: phy: Don't register LEDs for genphy
If a PHY has no driver, the genphy driver is probed/removed directly in
phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the
LEDs will be (un)registered when probing/removing the genphy driver.
This could occur if the leds are for a non-generic driver that isn't
loaded for whatever reason. Synchronously removing the PHY device in
phy_detach leads to the following deadlock:
rtnl_lock()
ndo_close()
...
phy_detach()
phy_remove()
phy_leds_unregister()
led_classdev_unregister()
led_trigger_set()
netdev_trigger_deactivate()
unregister_netdevice_notifier()
rtnl_lock()
There is a corresponding deadlock on the open/register side of things
(and that one is reported by lockdep), but it requires a race while this
one is deterministic.
Generic PHYs do not support LEDs anyway, so don't bother registering
them.
References
Configurations
Configuration 1 (hide)
|
History
18 Nov 2025, 18:09
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: phy: No registrar los LED para genphy. Si una PHY no tiene controlador, el controlador genphy se prueba/elimina directamente en phy_attach/detach. Si el nodo ofnode de la PHY tiene un subnodo "leds", los LED se (des)registrarán al probar/eliminar el controlador genphy. Esto podría ocurrir si los LED corresponden a un controlador no genérico que no está cargado por cualquier motivo. La eliminación sincrónica del dispositivo PHY en phy_detach genera el siguiente bloqueo: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() Existe un bloqueo correspondiente en el lado de apertura/registro (y este es reportado por lockdep), pero requiere una ejecución mientras que este es determinista. Los PHY genéricos no admiten LED de todos modos, así que no se moleste en registrarlos. | |
| References | () https://git.kernel.org/stable/c/75e1b2079ef0653a2f7aa69be515d86b7faf1908 - Patch | |
| References | () https://git.kernel.org/stable/c/ec158d05eaa91b2809cab65f8068290e3c05ebdd - Patch | |
| References | () https://git.kernel.org/stable/c/f0f2b992d8185a0366be951685e08643aae17d6d - Patch | |
| References | () https://git.kernel.org/stable/c/fd6493533af9e5d73d0d42ff2a8ded978a701dc6 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
18 Aug 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
16 Aug 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-16 12:15
Updated : 2025-11-18 18:09
NVD link : CVE-2025-38537
Mitre link : CVE-2025-38537
CVE.ORG link : CVE-2025-38537
JSON object : View
Products Affected
linux
- linux_kernel
CWE