CVE-2025-39905

A flaw was found in the Linux kernel’s phylink subsystem: when phylink_resolve() executes while pl->state_mutex is held, it may acquire pl->phydev->lock out of order relative to other paths (phylink_bringup_phy() or phylink_disconnect_phy()) that acquire pl->phydev->lock prior to pl->state_mutex. This lock inversion can result in a deadlock condition or other unexpected behaviour in PHY link management under concurrent operations

Red Hat rates this vulnerability as a Moderate impact because triggering the lock inversion requires local privileged interaction or precise timing during network link state changes, with the primary risk being a kernel deadlock leading to a denial of service. The issue resides in the kernel network PHY management layer, which handles link state negotiations for supported network adapters. Under standard enterprise configurations, physical or virtual interface reconfigurations require administrative privileges, limiting the exposure to environments undergoing frequent link state manipulation. Unprivileged remote users cannot directly induce this race condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.