CVE-2025-39905: Linux Kernel Race Condition Vulnerability

CVE-2025-39905 Overview

CVE-2025-39905 is a race condition [CWE-362] in the Linux kernel's phylink subsystem, which manages PHY (Physical Layer) network device links. The flaw exists in how phylink_resolve() serializes concurrent writes to pl->phydev from phylink_bringup_phy() and phylink_disconnect_phy(). The existing pl->state_mutex creates a lock inversion with pl->phydev->lock, leaving a window where pl->phydev can be dereferenced without proper protection. A local attacker with low privileges can trigger the race to corrupt kernel state, leading to memory safety impact on confidentiality, integrity, and availability.

Critical Impact
Local low-privilege attackers can exploit the lock inversion in phylink_resolve() to trigger kernel-level race conditions affecting confidentiality, integrity, and availability.

Affected Products

Linux Kernel 6.17-rc1
Linux Kernel 6.17-rc2 through 6.17-rc5
Linux distributions shipping affected mainline kernels

Discovery Timeline

2025-10-01 - CVE-2025-39905 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39905

Vulnerability Analysis

The phylink layer coordinates state between MAC drivers and PHY devices in the Linux networking stack. The phylink_resolve() worker function reads and operates on pl->phydev, while phylink_bringup_phy() and phylink_disconnect_phy() mutate that pointer during device attach and detach operations. Prior to the fix, serialization relied solely on pl->state_mutex.

This approach is unsafe because phylink_resolve() must acquire pl->phydev->lock before pl->state_mutex to avoid lock inversion. Acquiring the PHY lock first requires dereferencing pl->phydev, but doing so without holding pl->state_mutex is racy. The result is a Time-of-Check to Time-of-Use (TOCTOU) window during which a concurrent bringup or disconnect can invalidate the pointer.

The fix introduces an additional lock dedicated to serializing writes to pl->phydev against the resolver. This lock isolates the pointer-write path from the broader state_mutex and enables safe reordering of mutex_lock(&phy->lock) outside of the state_mutex critical section.

Root Cause

The root cause is a lock ordering conflict between pl->state_mutex and pl->phydev->lock. The kernel cannot both protect the pl->phydev pointer read and acquire the PHY lock in the correct order using only state_mutex.

Attack Vector

Exploitation requires local access with low privileges and involves triggering concurrent network interface operations that invoke phylink_bringup_phy() or phylink_disconnect_phy() while the resolver worker executes. Successful exploitation impacts kernel memory safety. High attack complexity reflects the timing precision required. No public proof-of-concept exists as of publication.

Refer to the upstream commit 56fe63b0 for the code-level fix that introduces the serializing lock.

Detection Methods for CVE-2025-39905

Indicators of Compromise

Unexpected kernel oops or NULL pointer dereference messages referencing phylink_resolve in dmesg or journalctl -k
Kernel lockdep warnings citing circular locking dependencies between state_mutex and PHY device locks
Network interface flapping or PHY attach/detach churn coinciding with kernel warnings

Detection Strategies

Monitor kernel logs for stack traces containing phylink_resolve, phylink_bringup_phy, or phylink_disconnect_phy frames
Enable CONFIG_PROVE_LOCKING on test kernels to surface lock inversion warnings
Track running kernel versions in fleet inventory and flag hosts running Linux 6.17-rc1 through 6.17-rc5

Monitoring Recommendations

Collect kernel ring buffer output centrally and alert on BUG:, WARNING:, or Oops: events referencing phylink
Correlate NIC driver reloads and link state transitions with kernel warning telemetry
Audit local user activity that repeatedly toggles interface state via ip link or PHY-related sysfs entries

How to Mitigate CVE-2025-39905

Immediate Actions Required

Upgrade to a Linux kernel build that includes commits 56fe63b0 and 0ba5b2f2 from the stable tree
Remove or downgrade any 6.17-rc kernels from production and pre-production hosts
Restrict local shell access on systems that cannot be patched immediately

Patch Information

The upstream fix is available in the mainline stable tree via commit 56fe63b05ec8 and commit 0ba5b2f2c381. Consume the fix through your distribution's stable kernel updates rather than cherry-picking manually where possible.

Workarounds

Limit local account creation and enforce least privilege to reduce the pool of potential attackers
Avoid running release-candidate kernels on multi-tenant or production hosts
Disable dynamic PHY attach/detach workflows on affected systems until patched

bash

# Verify running kernel is not an affected 6.17-rc build
uname -r

# Check for phylink-related kernel warnings
dmesg -T | grep -Ei 'phylink|lockdep|circular locking'

# Apply distribution kernel updates (Debian/Ubuntu example)
sudo apt update && sudo apt install --only-upgrade linux-image-generic
sudo reboot