CVE-2025-38726
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-11-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves a potential NULL pointer access in the ftgmac100 network driver. Specifically, after calling phy_disconnect(), the netdev->phydev pointer is reset to NULL, but the function fixed_phy_unregister() is then called with this NULL pointer, which can lead to a NULL pointer dereference. The fix involves caching the phy_device before calling fixed_phy_unregister() to avoid this issue.
How can this vulnerability impact me? :
The vulnerability can cause a NULL pointer dereference in the Linux kernel's network driver, which may lead to system instability or crashes. This could impact the reliability and availability of systems running the affected Linux kernel version.