Medium 5.5Published Sep 23, 2025

CVE-2025-39876net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()

Updated under an hour ago (Oct 26, 2026, 1:40 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() The function of_phy_find_device may return NULL, so we need to take care before dereferencing phy_dev.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 23, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	9e70485b40c8306298adea8bdc867ca27f88955a builds before 8c60d12bba14dc655d2d948b1dbf390b3ae39cb8; 64a632da538a6827fad0ea461925cedb9899ebe2 builds before 20a3433d31c2d2bf70ab0abec75f3136b42ae66c; from 64a632da538a6827fad0ea461925cedb9899ebe2 before 93a699d6e92cfdfa9eb9dbb8c653b5322542ca4f; 64a632da538a6827fad0ea461925cedb9899ebe2 builds before 5f1bb554a131e59b28482abad21f691390651752; from 64a632da538a6827fad0ea461925cedb9899ebe2 before fe78891f296ac05bf4e5295c9829ef822f3c32e7; 64a632da538a6827fad0ea461925cedb9899ebe2 builds before 4fe53aaa4271a72fe5fe3e88a45ce01646b68dc5; from 64a632da538a6827fad0ea461925cedb9899ebe2 before eb148d85e126c47d65be34f2a465d69432ca5541; 64a632da538a6827fad0ea461925cedb9899ebe2 builds before 03e79de4608bdd48ad6eec272e196124cefaf798; and 7 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 4.19.153 before 4.20; from 5.4.73 before 5.4.300; from 5.8.17 before 5.9; from 5.9.2 before 5.10.245; from 5.11 before 5.15.194; from 5.16 before 6.1.153; from 6.2 before 6.6.107; from 6.7 before 6.12.48; and 6 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/8c60d12bba14dc655d2d948b1dbf390b3ae39cb8	patch
https://git.kernel.org/stable/c/20a3433d31c2d2bf70ab0abec75f3136b42ae66c	patch
https://git.kernel.org/stable/c/93a699d6e92cfdfa9eb9dbb8c653b5322542ca4f	patch
https://git.kernel.org/stable/c/5f1bb554a131e59b28482abad21f691390651752	patch
https://git.kernel.org/stable/c/fe78891f296ac05bf4e5295c9829ef822f3c32e7	patch
https://git.kernel.org/stable/c/4fe53aaa4271a72fe5fe3e88a45ce01646b68dc5	patch
https://git.kernel.org/stable/c/eb148d85e126c47d65be34f2a465d69432ca5541	patch
https://git.kernel.org/stable/c/03e79de4608bdd48ad6eec272e196124cefaf798	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.