Linux Kernel Phylink MDIO Bus Power Management Vulnerability

Vulnerability

A vulnerability exists in the Linux kernel's handling of power management for MDIO bus-controlled PHYs when using the phylink framework. This issue primarily affects certain drivers that do not properly manage the PHY state during suspend and resume operations, leading to warnings and potential improper PHY state management. The problem arises because the phylink implementation does not align with the expected behavior for power management, especially for drivers that rely on the PHY state machine.

Impact

The vulnerability can cause improper management of the PHY state machine, leading to warnings and potential disruptions in PHY link management. This issue can cause the kernel to crash if not addressed, as the power management operations may not be properly synchronized with the PHY state machine's requirements.

Reproduction

The vulnerability can be reproduced by using a MAC driver that employs the phylink framework with MDIO-bus-managed PHY power management operations, but does not have MAC-managed power management enabled. When the driver is suspended and resumed, the PHY state machine may not be properly halted, causing a warning to be triggered and potentially leading to a PHY state misalignment.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
9.0
impact
2.5
exploitability
5.7
remediation
0.0
relevance
0.0
threat
4.8
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.