CVE-2025-38110

What it actually does

Missing validation of mdio address parameter in C45 mdiobus ioctl allows values exceeding PHY_MAX_ADDR, resulting in out-of-bounds read/write against the stats array.

Why it matters to the business

Attackers with local access can trigger memory corruption or information disclosure on Linux systems managing network PHY devices, increasing risk of kernel-level compromise especially in environments with high downstream kernel dependents.

How an attack unfolds

An attacker invokes publicly available tools such as mdio-tools to issue a C45 read or write ioctl supplying an mdio address greater than 31; the kernel accepts the value without bounds checking and performs an out-of-bounds access into the internal stats array, enabling memory corruption or leakage. Similar privilege-escalation patterns observed in related Linux kernel flaws have been leveraged by advanced spyware campaigns.

How to fix it

Update the Linux kernel to commit abb0605ca00979a49572a6516f6db22c3dc57223 or later; for affected nri-postgresql packages upgrade to version 2.18.0-r1 on both Chainguard and Wolfi distributions. Rebuild and reboot systems after applying the fixed kernel image.

How to confirm the fix worked

Confirm the running kernel contains commit abb0605ca00979a49572a6516f6db22c3dc57223 via uname or kernel build logs; test that ioctl calls with mdio addresses >= 32 are rejected before statistics collection occurs.

Typical attack path

1. Obtain local execution on a target Linux system exposing mdiobus ioctls
2. Invoke mdio-tools or equivalent to craft a C45 read/write request with mdio address >= 32
3. Trigger the unvalidated access path that indexes the stats array out of bounds
4. Use resulting memory corruption or disclosure to escalate privileges or exfiltrate data

How to detect it

Review system call audit logs for unusual ioctl invocations against mdiobus devices; correlate with process execution of mdio-tools or similar utilities. Threat actor references indicate monitoring for follow-on privilege escalation activity after initial access.

What your security team should do

• Immediately schedule kernel upgrades to the listed fixed commits or package versions 2.18.0-r1
• Restrict local access to users who must perform mdio operations until patches are deployed
• Monitor EPSS trend (currently rising) and reassess exploitation likelihood weekly