CVE-2025-71094

An input validation vulnerability was found in the Linux kernel's ASIX USB Ethernet driver. The driver reads the PHY address from the USB device without validating that it falls within the valid range (0 to PHY_MAX_ADDR-1). A malicious or faulty USB device can provide an invalid PHY address, causing a kernel warning when mdiobus_get_phy() attempts to use the out-of-range address.

This vulnerability requires physical access to connect a malicious USB device. The impact is limited to a kernel warning message; the invalid address is rejected before it can cause further damage. While the warning indicates a potential issue, it does not result in a crash or security compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.