CVE-2025-38149

What it actually does

Use-after-free condition in Linux kernel PHY layer where phydev->devlink retains a stale pointer after device_link_del(), leading to NULL pointer dereference in device_link_put_kref during subsequent phy_attach_direct failure paths.

Why it matters to the business

Unexpected system crashes during routine network interface disable/enable cycles on affected Linux distributions, causing service disruption and potential data loss in high-availability or containerized environments with many downstream dependents.

How an attack unfolds

An attacker with local access triggers repeated network port attach/detach sequences (via interface configuration or error injection) that hit the phy_attach_direct error path before device_link_add, causing the kernel to dereference the uncleared stale devlink pointer and panic.

How to fix it

Update to fixed kernel versions containing commit 363fdf2777423ad346d781f09548cca14877f729 or later; for croc packages upgrade to 10.2.2-r3 on Chainguard and Wolfi distributions. Reboot after applying kernel updates.

How to confirm the fix worked

Verify the presence of commit 363fdf2777423ad346d781f09548cca14877f729 in the running kernel source or package version; attempt the attach/detach sequence under error injection and confirm absence of the device_link_put_kref crash trace.

Typical attack path

1. Obtain local execution on target Linux system
2. Disable a network port to invoke phy_detach and device_link_del without clearing phydev->devlink
3. Re-enable the port such that phy_attach_direct fails before device_link_add
4. Trigger phy_detach again which calls device_link_del on the stale pointer
5. Cause kernel panic via NULL dereference in device_link_put_kref

How to detect it

Search kernel logs and dmesg for the call trace containing device_link_put_kref, device_link_del, phy_detach, and phy_attach_direct; correlate with network interface configuration events or container network setup failures around the published date.

What your security team should do

• Prioritize kernel updates on all internet-facing and high-availability Linux systems within the published remediation window
• Audit network interface management scripts and container runtimes for frequent attach/detach patterns
• Monitor kernel logs for device_link_del and phy_detach call traces indicating attempted exploitation
• Test the fix in a staging environment using the exact attach failure reproducer before broad deployment