CVE-2025-39876

What it actually does

Unchecked NULL return from of_phy_find_device() in fec_enet_phy_reset_after_clk_enable() leads to potential NULL pointer dereference in the FEC Ethernet driver.

Why it matters to the business

May cause system instability or crashes on Linux systems using the FEC network controller, affecting 4 downstream dependents and requiring kernel updates across affected distributions.

How an attack unfolds

An attacker with local access could attempt to trigger PHY reset paths after clock enable to cause the dereference, potentially leading to denial of service; related kernel privilege issues noted in campaigns like VMSCAPE.

How to fix it

Update Linux kernel to version 5.4.300 or apply commit 8c60d12bba14dc655d2d948b1dbf390b3ae39cb8. For ansible packages, update to 1.7.0+dfsg-1 on Debian releases.

How to confirm the fix worked

Verify kernel version is at least 5.4.300 and confirm the patch is applied by checking source for NULL check before dereferencing phy_dev.

Typical attack path

1. Identify systems with FEC driver
2. Manipulate network hardware or PHY state
3. Trigger clock enable and PHY reset sequence
4. Cause NULL dereference

How to detect it

Look for kernel oops or panic logs mentioning fec_enet_phy_reset_after_clk_enable or NULL pointer dereference in network stack; review related kernel privilege escalation attempts from noted threat actors.

What your security team should do

• Prioritize kernel updates on affected systems
• Monitor for network-related crashes
• Test updates in staging environments