CVE-2025-40239: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40239 is a NULL pointer dereference vulnerability in the Linux kernel's Micrel PHY driver (net/phy/micrel.c) affecting the LAN8814 Ethernet PHY chip. The flaw was disclosed on December 4, 2025, and stems from the PTP (Precision Time Protocol) probe failing to unconditionally set shared->phydev, which is later dereferenced during IRQ handling. Affected kernel versions span from the introduction of the vulnerable code (commit b3f1a08fcf0d) up to the patched stable releases. The EPSS score is approximately 0.017% (very low), and no CVSS base score has been formally assigned by the assigner (Feedly, ENISA EUVD).

The root cause is a missing unconditional assignment of shared->phydev during the LAN8814 PTP probe initialization (CWE-476: NULL Pointer Dereference). Specifically, the probe function only sets shared->phydev when a PTP clock is successfully registered; if PTP clock setup fails or is skipped, the pointer remains NULL. When an IRQ is subsequently handled — particularly in lan8814_gpio_process_cap — the code unconditionally dereferences shared->phydev, triggering a NULL pointer exception and kernel panic. The fix ensures shared->phydev is always assigned early in the probe path, regardless of PTP clock registration outcome (Feedly).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a complete denial of service for the affected host. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise. Systems using the Microchip LAN8814 PHY (commonly found in embedded networking and industrial hardware) are at risk if the PTP probe path does not successfully register a PTP clock (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-40239. The vulnerability requires local access or the ability to trigger IRQ handling on a system with a LAN8814 PHY in a specific misconfigured PTP state, making remote exploitation unlikely. The EPSS score is approximately 0.017%, reflecting very low exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include kernel 6.12.56, 6.17.6, and 6.18 (mainline). The relevant commits are da1ef8e9eb5d (for one stable branch), b093b06826b8 (for another), and 399d10934740 (for a third). Users should update to a patched kernel version as soon as possible. As a workaround, disabling PTP functionality on LAN8814-equipped interfaces may reduce exposure, though upgrading is the recommended remediation (Feedly, Kernel Stable).