CVE-2025-38111

In the Linux kernel, the following vulnerability has been resolved:

net/mdiobus: Fix potential out-of-bounds read/write access

When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write.

Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation.

A flaw in the mdiobus subsystem allowed unvalidated MDIO addresses to be passed via ioctl, which could result in out-of-bounds read or write access to the internal statistics array (bus->stats[]). This issue was fixed by adding boundary checks to reject addresses ≥ PHY_MAX_ADDR (typically 32), thus preventing potential memory corruption. A local privileged attacker could exploit this flaw to read or write beyond the bounds of the stats array, potentially leaking limited kernel memory or corrupting adjacent structures. However, there is no evidence this can lead to code execution or denial of service. The Privileges Required are High (PR:H), because accessing the MDIO ioctl interface requires root privileges or capabilities such as CAP_NET_ADMIN. Unprivileged users cannot directly exploit this interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.