Security tracker / CVE-2025-37945

CVE-2025-37945

net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 744d23c71af3 ("net: phy: Warn about incorrect
 carnil> mdio_bus_phy_resume() state"). Vulnerable versions: 5.15.63 5.19.4 6.0.

Bugs

Status

Branch	Status
upstream	released (6.15-rc2) [fc75ea20ffb452652f0d4033f38fe88d7cfdae35]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	N/A "Fixed before branching point"
6.14-upstream-stable	released (6.14.3) [bd4037d51d3f6667636a1383e78e48a5b7b60755]
6.12-upstream-stable	released (6.12.24) [a6ed6f8ec81b8ca7100dcd9e62bdbc0dff1b2259]
6.6-upstream-stable	needed
6.1-upstream-stable	needed
5.10-upstream-stable	N/A "Vulnerable code not present"
sid	released (6.12.25-1)
6.12-trixie-security	N/A "Fixed before branching point"
6.1-bookworm-security	needed
5.10-bullseye-security	N/A "Vulnerable code not present"