CVE-2025-39805

What it actually does

Incorrect sequencing in macb_remove() calls phy_exit() while the netdev remains registered, causing kernfs to warn on attempted removal of 'attached_dev' sysfs link during phy_detach.

Why it matters to the business

Device removal or driver unload on affected Linux systems produces kernel warnings and may contribute to minor instability or logging noise in network hardware environments; high downstream kernel prevalence amplifies patch urgency despite low exploit likelihood.

How an attack unfolds

An attacker or administrator triggers macb device removal (module unload, hot-unplug, or platform remove); the flawed ordering in macb_remove() executes phy_disconnect while the netdev is still registered, surfacing the kernfs warning. No known threat actors or ransomware usage.

How to fix it

Update the Linux kernel to a version containing commit 7351782f2fc8ac31ced52e3d4e6fa120f819a7ab (or later stable backports) which reorders unregister_netdev ahead of phy_exit and MDIO cleanup. Reboot after upgrade and verify driver load.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; reproduce device removal and ensure no 'kernfs: can not remove' warnings appear in dmesg; inspect macb_remove call order in source if building custom kernels.

Typical attack path

1. Load or bind macb driver to network device
2. Initiate device removal or module unload
3. macb_remove executes phy_exit before unregister_netdev
4. kernfs warning emitted during sysfs link cleanup

How to detect it

Search kernel logs (dmesg, journalctl, /var/log/kern.log) for the exact warning text emitted from fs/kernfs/dir.c during macb_remove or platform_remove paths; correlate with phylink or macb module activity.

• kernfs: can not remove 'attached_dev', no directory
• WARNING: CPU.*at fs/kernfs/dir.c:1683
• macb_remove.*platform_remove
• phy_detach.*phy_disconnect.*phylink_disconnect_phy

What your security team should do

• Prioritize kernel package updates containing the fix across all affected distributions
• Monitor kernel logs for the specific kernfs warning string during maintenance windows
• Schedule testing of network device hot-plug and driver unload paths post-update