What’s Vulnerable › Vulnerabilities

CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-23 · updated 2026-10-19
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() The function of_phy_find_device may return NULL, so we need to take care before dereferencing phy_dev.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 4.19.153 before 4.20; from 5.4.73 before 5.4.300; from 5.8.17 before 5.9; from 5.9.2 before 5.10.245; from 5.11 before 5.15.194; from 5.16 before 6.1.153 — fixed in 4.20, 5.10.245, 5.15.194, 5.4.300, 5.9, 6.1.153

How to fix

Upgrade to a fixed version: Linux kernel 4.20, 5.10.245, 5.15.194, 5.4.300. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/03e79de4608bdd48ad6eec272e196124cefaf798
• https://git.kernel.org/stable/c/20a3433d31c2d2bf70ab0abec75f3136b42ae66c
• https://git.kernel.org/stable/c/4fe53aaa4271a72fe5fe3e88a45ce01646b68dc5
• https://git.kernel.org/stable/c/5f1bb554a131e59b28482abad21f691390651752
• https://git.kernel.org/stable/c/8c60d12bba14dc655d2d948b1dbf390b3ae39cb8
• https://git.kernel.org/stable/c/93a699d6e92cfdfa9eb9dbb8c653b5322542ca4f
• https://git.kernel.org/stable/c/eb148d85e126c47d65be34f2a465d69432ca5541
• https://git.kernel.org/stable/c/fe78891f296ac05bf4e5295c9829ef822f3c32e7
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Get alerted when CVE-2025-39876 or the next vulnerability affects your stack