CVE-2025-71094: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71094 is a missing input validation vulnerability in the Linux kernel's ASIX USB network driver (net/usb/asix) that can allow a malicious or faulty USB device to trigger a kernel warning and potential denial of service. The ASIX driver reads the PHY address from a connected USB device via asix_read_phy_addr() without validating that the returned value is within the acceptable range (< PHY_MAX_ADDR), causing a warning in mdiobus_get_phy() when an out-of-range address (e.g., 207) is supplied. It was published on January 13, 2026, and affects multiple Linux kernel versions from 5.13.13 through 6.18.x and 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is insufficient input validation (CWE classified as NVD-CWE-noinfo) in the asix_read_phy_addr() function within drivers/net/usb/asix_common.c. When a USB device returns a PHY address value greater than or equal to PHY_MAX_ADDR (32), the kernel passes this invalid value to mdiobus_get_phy(), which emits a WARN() at drivers/net/phy/mdio_bus.c:76. The attack vector is local (physical USB access required), with low attack complexity and low privileges needed — an attacker must be able to connect a crafted or malicious USB ASIX-compatible device to the target system. The fix validates the PHY address in asix_read_phy_addr() and removes a now-redundant check in ax88172a.c (Feedly, kernel.org patches).

Exploitation of this vulnerability primarily affects system availability: a malicious or faulty USB device can trigger a kernel warning (WARN()) in mdiobus_get_phy(), which may lead to system instability or denial of service through repeated triggering. There is no confidentiality or integrity impact as assessed by the CVSS score (C:N/I:N/A:H). The scope is limited to the local system where the malicious USB device is connected, with no known potential for lateral movement or remote exploitation (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log such as addr [number] out of range originating from drivers/net/phy/mdio_bus.c:76; repeated WARNING: entries associated with ASIX USB driver initialization.
• Hardware/USB: Unexpected or unrecognized USB ASIX-compatible network adapter connected to the system; USB device enumeration logs showing a new ASIX device (Vendor ID 0x0B95 or similar) attached without authorization.

Upstream kernel patches are available across multiple stable branches: upgrade to Linux kernel 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.4, or 6.19-rc4 (or later) to receive the fix (kernel.org patches). Distribution-specific updates are available from Red Hat, Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Debian, and Oracle Linux (Red Hat CVE, Ubuntu USN-8177-1). As a workaround, restrict physical access to USB ports and implement USB device allowlisting policies to prevent connection of untrusted USB devices.