CVE-2025-39905

What it actually does

Race condition in phylink allows concurrent unsynchronized writes to pl->phydev during resolver operations, potentially causing inconsistent PHY state or use-after-free conditions in the network link handling code.

Why it matters to the business

Linux systems handling network interfaces may experience intermittent link instability, packet loss, or kernel crashes under concurrent network configuration loads, affecting availability of network-dependent services.

How an attack unfolds

An attacker with local access or the ability to trigger repeated link configuration changes can race resolver threads against PHY device updates to corrupt internal state; no public exploits or named threat actors are associated with this issue.

How to fix it

Update affected git packages to the fixed versions listed (SUSE Linux Enterprise Module for Basesystem 15: 2.16.4-3.3.2; SUSE Linux Enterprise Module for Development Tools 15: 2.16.4-3.3.2; upstream Linux stable: commit 56fe63b05ec84ae6674269d78397cec43a7a295a or later) and rebuild or reboot into the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 56fe63b05ec84ae6674269d78397cec43a7a295a or the corresponding SUSE package version; inspect phylink.c for presence of the added serialization lock around pl->phydev accesses.

Typical attack path

1. Obtain local execution or network configuration privileges on an affected Linux system
2. Trigger repeated concurrent operations that invoke phylink resolver and PHY device updates simultaneously
3. Exploit resulting inconsistent pl->phydev state to induce denial of service or kernel instability

How to detect it

Review kernel logs for phylink-related warnings, oops, or panic messages around link configuration events; correlate timestamps of network interface flaps with resolver activity in system logs.

What your security team should do

• Prioritize patching systems exposed to frequent link state changes or multi-threaded network configuration
• Apply the listed fixed package versions and schedule kernel reboots within standard maintenance windows
• Monitor vendor advisories for any downstream dependents that pull this upstream fix