# CVE-2025-38725

## Summary

- **CVE ID:** CVE-2025-38725
- **Severity:** MEDIUM
- **CVSS Score:** 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Sep 4, 2025
- **Last Modified:** Sep 8, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: asix_devices: add phy_mask for ax88772 mdio bus

Without setting phy_mask for ax88772 mdio bus, current driver may create
at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f.
DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy
device will bind to net phy driver. This is creating issue during system
suspend/resume since phy_polling_mode() in phy_state_machine() will
directly deference member of phydev->drv for non-main phy devices. Then
NULL pointer dereference issue will occur. Due to only external phy or
internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud
the issue.

## Affected Products

- Linux — Linux (e532a096be0e5e570b383e71d4560e7f04384e0f)
- Linux — Linux (5.14)
- Linux — Linux (0)
- Linux — Linux (5.15.190)
- Linux — Linux (6.1.149)
- Linux — Linux (6.6.103)
- Linux — Linux (6.12.43)
- Linux — Linux (6.15.11)
- Linux — Linux (6.16.2)
- Linux — Linux (6.17)

## References

- [CNA](https://git.kernel.org/stable/c/75947d3200de98a9ded9ad8972e02f1a177097fe)
- [CNA](https://git.kernel.org/stable/c/59ed6fbdb1bc03316e09493ffde7066f031c7524)
- [CNA](https://git.kernel.org/stable/c/ccef5ee4adf56472aa26bdd1f821a6d0cd06089a)
- [CNA](https://git.kernel.org/stable/c/ee2cd40b0bb46056949a2319084a729d95389386)
- [CNA](https://git.kernel.org/stable/c/a754ab53993b1585132e871c5d811167ad3c52ff)
- [CNA](https://git.kernel.org/stable/c/ad1f8313aeec0115f9978bd2d002ef4a8d96c773)
- [CNA](https://git.kernel.org/stable/c/4faff70959d51078f9ee8372f8cff0d7045e4114)
- [CVE](https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.15%
- **EPSS Percentile:** 4.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._