Back
CVE-2025-39876net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
- 5.5MediumCVSS base score
- 0.15%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() The function of_phy_find_device may return NULL, so we need to take care before dereferencing phy_dev.
Timeline
ID reserved
By Linux
- 5 months later
· 5 months later
Published
- 8 months later
· 8 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.15% · top 95% of all CVEs (15 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 9e70485b40c8306298adea8bdc867ca27f88955a – < 8c60d12bba14dc655d2d948b1dbf390b3ae39cb8
- affected 64a632da538a6827fad0ea461925cedb9899ebe2 – < 20a3433d31c2d2bf70ab0abec75f3136b42ae66c
- affected 64a632da538a6827fad0ea461925cedb9899ebe2 – < 93a699d6e92cfdfa9eb9dbb8c653b5322542ca4f
- affected 64a632da538a6827fad0ea461925cedb9899ebe2 – < 5f1bb554a131e59b28482abad21f691390651752
- affected 64a632da538a6827fad0ea461925cedb9899ebe2 – < fe78891f296ac05bf4e5295c9829ef822f3c32e7
- affected 64a632da538a6827fad0ea461925cedb9899ebe2 – < 4fe53aaa4271a72fe5fe3e88a45ce01646b68dc5
- affected 64a632da538a6827fad0ea461925cedb9899ebe2 – < eb148d85e126c47d65be34f2a465d69432ca5541
- affected 64a632da538a6827fad0ea461925cedb9899ebe2 – < 03e79de4608bdd48ad6eec272e196124cefaf798
- affected c068e505f229ca5f778f825f1401817ce818e917
- affected 8a6ab151443cd71e2aa5e8b7014e3453dbd51935
- affected ce88b5f42868ef4964c497d4dfcd25e88fd60c5b
- affected 5.4.73 – < 5.4.300
- affected 4.19.153 – < 4.20
- affected 5.8.17 – < 5.9
- affected 5.9.2 – < 5.10
- affected 5.10
- unaffected < 5.10
- unaffected 5.4.300 – ≤ 5.4.*
- unaffected 5.10.245 – ≤ 5.10.*
- unaffected 5.15.194 – ≤ 5.15.*
- unaffected 6.1.153 – ≤ 6.1.*
- unaffected 6.6.107 – ≤ 6.6.*
- unaffected 6.12.48 – ≤ 6.12.*
- unaffected 6.16.8 – ≤ 6.16.*
- unaffected 6.17 – ≤ *
References
References9
- https://git.kernel.org/stable/c/8c60d12bba14dc655d2d948b1dbf390b3ae39cb8 (opens in a new tab)
- https://git.kernel.org/stable/c/20a3433d31c2d2bf70ab0abec75f3136b42ae66c (opens in a new tab)
- https://git.kernel.org/stable/c/93a699d6e92cfdfa9eb9dbb8c653b5322542ca4f (opens in a new tab)
- https://git.kernel.org/stable/c/5f1bb554a131e59b28482abad21f691390651752 (opens in a new tab)
- https://git.kernel.org/stable/c/fe78891f296ac05bf4e5295c9829ef822f3c32e7 (opens in a new tab)
- https://git.kernel.org/stable/c/4fe53aaa4271a72fe5fe3e88a45ce01646b68dc5 (opens in a new tab)
- https://git.kernel.org/stable/c/eb148d85e126c47d65be34f2a465d69432ca5541 (opens in a new tab)
- https://git.kernel.org/stable/c/03e79de4608bdd48ad6eec272e196124cefaf798 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-30867 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-39876)Record last updated .