{"id":"DEBIAN-CVE-2025-38149","details":"In the Linux kernel, the following vulnerability has been resolved:  net: phy: clear phydev-\u003edevlink when the link is deleted  There is a potential crash issue when disabling and re-enabling the network port. When disabling the network port, phy_detach() calls device_link_del() to remove the device link, but it does not clear phydev-\u003edevlink, so phydev-\u003edevlink is not a NULL pointer. Then the network port is re-enabled, but if phy_attach_direct() fails before calling device_link_add(), the code jumps to the \"error\" label and calls phy_detach(). Since phydev-\u003edevlink retains the old value from the previous attach/detach cycle, device_link_del() uses the old value, which accesses a NULL pointer and causes a crash. The simplified crash log is as follows.  [   24.702421] Call trace: [   24.704856]  device_link_put_kref+0x20/0x120 [   24.709124]  device_link_del+0x30/0x48 [   24.712864]  phy_detach+0x24/0x168 [   24.716261]  phy_attach_direct+0x168/0x3a4 [   24.720352]  phylink_fwnode_phy_connect+0xc8/0x14c [   24.725140]  phylink_of_phy_connect+0x1c/0x34  Therefore, phydev-\u003edevlink needs to be cleared when the device link is deleted.","modified":"2026-08-27T23:05:21.319827786Z","published":"2025-07-03T09:15:29.830Z","upstream":["CVE-2025-38149"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38149"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38149.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38149.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}