CVE-2025-71094: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71094 is a missing input validation vulnerability in the Linux kernel's ASIX USB network driver (net/usb/asix) that can allow a malicious or faulty USB device to trigger a kernel warning and potential denial of service. The ASIX driver reads the PHY address from a connected USB device via asix_read_phy_addr() without validating that the returned value is within the acceptable range (< PHY_MAX_ADDR), causing a warning in mdiobus_get_phy() when an out-of-range address (e.g., 207) is supplied. It was published on January 13, 2026, and affects multiple Linux kernel versions from 5.13.13 through 6.18.x and 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is insufficient input validation (CWE classified as NVD-CWE-noinfo) in the asix_read_phy_addr() function within drivers/net/usb/asix_common.c. When a USB device returns a PHY address value greater than or equal to PHY_MAX_ADDR (32), the kernel passes this invalid value to mdiobus_get_phy(), which emits a WARN() at drivers/net/phy/mdio_bus.c:76. The attack vector is local (physical USB access required), with low attack complexity and low privileges needed — an attacker must be able to connect a crafted or malicious USB ASIX-compatible device to the target system. The fix validates the PHY address in asix_read_phy_addr() and removes a now-redundant check in ax88172a.c (Feedly, kernel.org patches).

Exploitation of this vulnerability primarily affects system availability: a malicious or faulty USB device can trigger a kernel warning (WARN()) in mdiobus_get_phy(), which may lead to system instability or denial of service through repeated triggering. There is no confidentiality or integrity impact as assessed by the CVSS score (C:N/I:N/A:H). The scope is limited to the local system where the malicious USB device is connected, with no known potential for lateral movement or remote exploitation (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires physical access to connect a malicious USB device, significantly limiting the attack surface (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log such as addr [number] out of range originating from drivers/net/phy/mdio_bus.c:76; repeated WARNING: entries associated with ASIX USB driver initialization.
• Hardware/USB: Unexpected or unrecognized USB ASIX-compatible network adapter connected to the system; USB device enumeration logs showing a new ASIX device (Vendor ID 0x0B95 or similar) attached without authorization.

Upstream kernel patches are available across multiple stable branches: upgrade to Linux kernel 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.4, or 6.19-rc4 (or later) to receive the fix (kernel.org patches). Distribution-specific updates are available from Red Hat, Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Debian, and Oracle Linux (Red Hat CVE, Ubuntu USN-8177-1). As a workaround, restrict physical access to USB ports and implement USB device allowlisting policies to prevent connection of untrusted USB devices.