CVE-2025-39805: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39805 is a Linux kernel vulnerability in the macb network driver caused by an incorrect device removal call order in macb_remove(). When removing a macb device, the driver incorrectly calls phy_exit() before unregister_netdev(), triggering a kernfs warning (kernfs: can not remove 'attached_dev', no directory) and potential system instability. The vulnerability affects Linux kernel versions from 5.18 up to (but not including) 6.12.45, versions 6.13 through 6.16.4, and release candidates 6.17-rc1 through 6.17-rc3. It was published on September 16, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is an improper resource cleanup ordering (CWE-459 / improper cleanup) in the macb_remove() function of the Linux kernel's net/macb Ethernet driver. The driver calls phy_exit() before unregister_netdev(), causing the PHY subsystem to attempt removal of the attached_dev sysfs link while the network device is still registered, resulting in a kernel warning from kernfs_remove_by_name_ns at fs/kernfs/dir.c:1683. The call trace flows through phy_detach() → phy_disconnect() → phylink_disconnect_phy() → macb_close() → macb_remove() → platform_remove(). The fix moves unregister_netdev() ahead of phy_exit() in macb_remove() to enforce the correct teardown sequence (Red Hat Bugzilla, Kernel Patch 1).

Exploitation of this vulnerability by a local, low-privileged user can cause a denial of service through kernel warnings and potential system instability during network device removal. There is no confidentiality or integrity impact; the primary risk is availability degradation affecting the reliability of network interface management on systems using the macb Ethernet driver (common in embedded and ARM-based platforms). The vulnerability does not enable lateral movement or data exfiltration (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-39805. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term (Red Hat CVE).

Update to a patched Linux kernel version: 6.12.45 or later for the 6.12 stable series, or 6.16.5 or later for the 6.16 series; the fix is also included in 6.17-rc4 and later. Vendor-specific patches are available from Red Hat, SUSE (SUSE-SU-2025:4393-1 and related advisories), Debian (DSA-6008-1, DLA-4436-1), and Ubuntu (USN-8095-1 through USN-8095-5, USN-8100-1, USN-8125-1, USN-8165-1). Systems not using the macb Ethernet driver (primarily embedded/ARM platforms) are not affected and require no action (Red Hat Bugzilla, Kernel Patch 1).