USB Connectivity Issue in Linux Kernel Affecting D-Link Devices

CVE-2025-38725

What is CVE-2025-38725?

A vulnerability in the Linux kernel affects the D-Link DUB-E100 H/W Ver B1, which utilizes the ax88772 MDIO bus. The driver fails to correctly set the phy_mask for these devices, resulting in a limitation of 32 MDIO PHY devices with addresses ranging from 0x00 to 0x1f. Consequently, during system suspend/resume, there can be issues with the phy_polling_mode() in the phy_state_machine(), potentially leading to a NULL pointer dereference when the driver interacts with non-main PHY devices. This problem necessitates the addition of a phy_mask to ensure proper functionality.

References