LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71094: net: usb: asix: validate PHY address before use

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy(): addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76 Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the ASIX USB Ethernet driver. A malicious or faulty USB network adapter can report an invalid PHY address, causing a kernel warning. The source does not show remote attackability, privilege escalation, data theft, active exploitation, or a CVSS score.

Executive priority

Treat as a targeted device-triggered kernel robustness issue, not a confirmed internet-exposed emergency. Prioritize patching on workstations, labs, kiosks, and servers where USB Ethernet devices are used or physically accessible.

Technical view

The ASIX driver used a PHY address returned by the USB device without validating it against PHY_MAX_ADDR. Invalid values reach mdiobus_get_phy() and trigger an out-of-range warning. Stable kernel commits add validation in asix_read_phy_addr() and remove a redundant downstream check.

Likely exposure

Exposure is most relevant to Linux systems that use ASIX USB Ethernet adapters, especially environments where untrusted or faulty USB devices can be connected. The bundle does not support network-only exposure.

Exploitation context

The CVE source describes a malicious or faulty device as the trigger. CISA KEV is false in the bundle, and no cited source states active exploitation or public weaponization.

Researcher notes

Evidence is limited to the CVE record and Linux stable commit references. Impact beyond a kernel warning is not established in the bundle. Validate affectedness through the distro kernel source or backport notes rather than raw upstream version strings alone.

Mitigation direction

  • Update to a kernel build containing the referenced stable ASIX fix commits.
  • Use distribution kernel advisories to map the fix to package versions.
  • Restrict untrusted USB Ethernet adapters until affected systems are updated.
  • Review vendor guidance if kernel updates are not immediately available.

Validation and detection

  • Inventory Linux endpoints using ASIX USB Ethernet adapters or the asix driver.
  • Check running kernel versions against distribution advisories for CVE-2025-71094.
  • Confirm deployed kernels include the referenced stable fix or distro backport.
  • Review kernel logs for ASIX or MDIO out-of-range PHY warnings.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71094 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7e88b11a862afe59ee0c365123ea5fb96a26cb3b, 7e88b11a862afe59ee0c365123ea5fb96a26cb3b, 7e88b11a862afe59ee0c365123ea5fb96a26cb3b, 7e88b11a862afe59ee0c365123ea5fb96a26cb3b, 7e88b11a862afe59ee0c365123ea5fb96a26cb3b, 7e88b11a862afe59ee0c365123ea5fb96a26cb3b, 4e4f3cb41d687bd64cd03358862b23c84d82329e, 5.13.13unaffected
LinuxLinux5.14, 0, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.4, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.