CVE-2025-38110

A flaw was found in the Linux kernel's MDIO (Management Data Input/Output) bus subsystem. This vulnerability allows a local user with administrative privileges to cause memory corruption or information disclosure by supplying an out-of-range physical layer (PHY) address through an input/output control (ioctl) command. Due to missing boundary checks during Clause 45 operations, the kernel accesses an internal statistics array beyond its allocated bounds.

A bounds check was missing in the __mdiobus_c45_read() and __mdiobus_c45_write() functions, allowing out-of-bounds access to the stats array in the kernel if a user supplied an invalid PHY address via an ioctl. Although the read/write would typically fail on hardware, the statistics array was still accessed, potentially leading to an out-of-bounds memory read/write in kernel space. This patch adds a check that ensures the PHY address does not exceed PHY_MAX_ADDR, mitigating the risk. The Privileges required for the CVSS is High (PR: H), because requires administrative privileges to issue raw ioctl commands to a network interface (typically CAP_NET_ADMIN). Potential memory corruption could happen inside the firmware of the networking hardware, but not for the memory of the Linux Kernel, and this is the reason why no Kernel Crash could be (and A:N for CVSS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module mdio from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.