Answer in brief
CVE-2025-71094 records a Unknown severity vulnerability in net: usb: asix: validate PHY address before use. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7e88b11a862afe59ee0c365123ea5fb96a26cb3b <fc96018f09f8d30586ca6582c5045a84eafef146 || >=7e88b11a862afe59ee0c365123ea5fb96a26cb3b <f5f4f30f3811d37e1aa48667c36add74e5a8d99f || >=7e88b11a862afe59ee0c365123ea5fb96a26cb3b <38722e69ee64dbb020028c93898d25d6f4c0e0b2 || >=7e88b11a862afe59ee0c365123ea5fb96a26cb3b <98a12c2547a44a5f03f35c108d2022cc652cbc4d || >=7e88b11a862afe59ee0c365123ea5fb96a26cb3b <bf8a0f3b787ca7c5889bfca12c60c483041fbee3 || >=7e88b11a862afe59ee0c365123ea5fb96a26cb3b <a1e077a3f76eea0dc671ed6792e7d543946227e8 || 4e4f3cb41d687bd64cd03358862b23c84d82329e || >=5.13.13 <5.14 | fc96018f09f8d30586ca6582c5045a84eafef146, f5f4f30f3811d37e1aa48667c36add74e5a8d99f, 38722e69ee64dbb020028c93898d25d6f4c0e0b2, 98a12c2547a44a5f03f35c108d2022cc652cbc4d, bf8a0f3b787ca7c5889bfca12c60c483041fbee3, a1e077a3f76eea0dc671ed6792e7d543946227e8, 5.14 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Jan 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 19, 2026
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy(): addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76 Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c.
Quoted source text, attributed separately from HOL analysis.