CVE-2025-38736

What it actually does

Missing 5-bit mask on PHY address during MDIO bus init in asix USB Ethernet driver allows shift-out-of-bounds and invalid address use, leading to kernel memory corruption or exception.

Why it matters to the business

Systems using affected ASIX USB Ethernet adapters risk local kernel crashes, denial of service, or potential privilege escalation; 417 days of exposure and multiple related kernel privilege-escalation reports increase operational risk for Linux hosts and containers.

How an attack unfolds

A local attacker with low privileges triggers MDIO bus initialization on an affected USB device; the unmasked PHY address causes an out-of-bounds shift or invalid register access. Threat actors including VMSCAPE have been observed targeting similar Linux kernel privilege-escalation flaws on container-optimized OS environments.

How to fix it

Update the Linux kernel to the fixed commit fcb4ce9f729c1d08e53abf9d449340e24c3edee6 in the stable tree; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit fcb4ce9f729c1d08e53abf9d449340e24c3edee6; re-test MDIO initialization with boundary PHY addresses 0-31 and verify absence of shift-out-of-bounds exceptions.

Typical attack path

1. Obtain local user or container access on a Linux system with an ASIX USB Ethernet adapter
2. Trigger or wait for MDIO bus initialization in the asix driver
3. Supply or force an unmasked PHY address value exceeding 5 bits
4. Cause shift-out-of-bounds exception or invalid MDIO operation leading to kernel fault or corruption

How to detect it

Search kernel logs and dmesg for shift-out-of-bounds exceptions or MDIO errors during asix device initialization; correlate with USB device attach events on systems running unpatched kernels.

What your security team should do

• Apply the kernel fix immediately on internet-facing and container hosts
• Audit systems for presence of ASIX USB Ethernet devices
• Monitor kernel logs for shift-out-of-bounds or MDIO-related faults until patched
• Restrict unprivileged local access where feasible until remediation is complete