CVE Explorer

CVE-2025-71094

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy(): addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76 Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f2a9916d4170996cca14621d43046c5bbd955f2ee279549cccc642de8bd3ff76

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/asix_common.c","drivers/net/usb/ax88172a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.198","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.160","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.120…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/asix_common.c","drivers/net/usb/ax88172a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fc96018f09f8d30586ca6582c5045a84eafef146","status":"affected","version":"7e88b11a862afe59ee0c365123ea5fb96a26cb3b","versionType":"git"},{"lessThan":"f5f4f30f3811d37e1aa48667c36add74e5a8d99f","status":"affected","version":"7e88b11a862afe59ee0c365123ea5fb96a26cb3b","versionType":"git"},{"lessThan":"38722e69ee64dbb020028c93898d25d6f4c0e0b2","status":"affected…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/affected/0

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/38722e69ee64dbb020028c93898d25d6f4c0e0b2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/98a12c2547a44a5f03f35c108d2022cc652cbc4d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/a1e077a3f76eea0dc671ed6792e7d543946227e8"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/bf8a0f3b787ca7c5889bfca12c60c483041fbee3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/f5f4f30f3811d37e1aa48667c36add74e5a8d99f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/fc96018f09f8d30586ca6582c5045a84eafef146"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:dcfad51096d6fa1b8b4a15a1b80fdd4c3a210760e789246785f0bce481c4e4c1 · sha256:83a5c637d49161bb… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer