CVE-2025-38110: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38110 Overview

CVE-2025-38110 is an out-of-bounds read/write vulnerability in the Linux kernel's net/mdiobus subsystem. The flaw exists in the clause 45 (C45) MDIO bus handling code, which fails to validate the MDIO address supplied through ioctl calls. The kernel defines PHY_MAX_ADDR as 32, but user-supplied addresses exceeding this bound can be passed to the driver. While the actual read/write operation typically fails, mdiobus maintains a statistics array indexed by that address, enabling out-of-bounds access.

Critical Impact
A local, low-privileged user can trigger out-of-bounds reads and writes in kernel memory via crafted C45 MDIO ioctl requests, leading to information disclosure or denial of service.

Affected Products

Linux Kernel stable branches prior to the fix commits
Linux Kernel 6.16-rc1
Systems exposing mdiobus ioctl access to unprivileged users (via tools such as mdio-tools)

Discovery Timeline

2025-07-03 - CVE-2025-38110 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38110

Vulnerability Analysis

The Linux kernel's Media Independent Interface (MDIO) bus subsystem provides an interface for accessing PHY (physical layer) devices attached to network interfaces. Clause 45 of IEEE 802.3 extends the addressing scheme used to communicate with these PHYs. Userspace tools such as mdio-tools issue ioctl requests to read and write PHY registers through the MDIO bus.

The C45 handler in net/mdiobus accepts an MDIO address from userspace without validating it against PHY_MAX_ADDR (32). The mdiobus structure contains a statistics array sized by PHY_MAX_ADDR, and every C45 access path updates counters at the caller-supplied index. Supplying an address greater than or equal to 32 causes indexing beyond the statistics array. This maps to Out-of-Bounds Read [CWE-125] and its write counterpart on the statistics update path.

Root Cause

The root cause is missing input validation on the MDIO address parameter before the C45 read/write routines dereference the per-address statistics array. The kernel trusted the address value supplied through ioctl rather than range-checking it against PHY_MAX_ADDR.

Attack Vector

Exploitation requires local access and the ability to issue SIOCGMIIREG/SIOCSMIIREG-family ioctl calls against a network interface configured for C45 MDIO. An attacker with CAP_NET_ADMIN or otherwise sufficient privileges on the target interface can pass an MDIO address greater than PHY_MAX_ADDR and cause the kernel to read from or write to memory outside the statistics array. Detailed exploitation code is not published in the referenced kernel commits; refer to the upstream patches for the exact affected code paths.

Detection Methods for CVE-2025-38110

Indicators of Compromise

Unexpected use of mdio-tools binaries (mdio, mdio-bench) by non-administrative users
ioctl calls to network interfaces referencing MDIO addresses greater than or equal to 32
Kernel warnings, KASAN reports, or oops messages originating from net/mdiobus code paths
Unexplained network interface or PHY state changes correlated with local user activity

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) in test environments to surface the out-of-bounds access
Audit execve telemetry for mdio-tools execution combined with ioctl syscall arguments
Monitor kernel ring buffer (dmesg) for mdiobus-related warnings and traces
Compare running kernel version against the fixed commits 260388f7, 31bf7b2b, 4ded22f7, and abb0605c

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on mdiobus stack traces
Track privilege grants that add CAP_NET_ADMIN to non-service accounts
Baseline expected usage of MDIO management tools on network appliances and alert on deviations

How to Mitigate CVE-2025-38110

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits
Restrict access to network management tooling and remove unnecessary CAP_NET_ADMIN grants
Uninstall or restrict mdio-tools on production hosts where PHY access is not required
Prioritize patching on embedded, networking, and industrial systems that expose C45 MDIO buses

Patch Information

Upstream fixes add address verification against PHY_MAX_ADDR before executing C45 read and write operations. Statistics updates are skipped for out-of-range addresses. The fix is available in the following commits: Kernel Git Commit 260388f, Kernel Git Commit 31bf7b2, Kernel Git Commit 4ded22f, and Kernel Git Commit abb0605c. Consult your Linux distribution's security tracker for backported updates.

Workarounds

Revoke CAP_NET_ADMIN from untrusted users and services on affected hosts
Remove or restrict execution of mdio-tools binaries via file permissions or Mandatory Access Control (MAC) policies such as SELinux or AppArmor
Where feasible, disable driver support for C45 MDIO on systems that do not require it

bash

# Example: restrict mdio-tools execution to root only
sudo chown root:root /usr/bin/mdio
sudo chmod 700 /usr/bin/mdio

# Verify running kernel against fixed commits
uname -r