cve 2025 38111

CVE-2025-38111 is a Linux kernel vulnerability in the MDIO (Management Data Input/Output) subsystem, specifically in the net/mdiobus code. The flaw involves a missing bounds check in an ioctl path that allows a user-supplied MDIO address to read or write beyond the kernel's mdiobus statistics array. This out-of-bounds access could be exploited by local users or tooling with access to MDIO management. The fix is a small patch that adds proper bounds checking, preventing the out-of-bounds condition. Administrators should apply the patch urgently on systems that expose MDIO management to local users. The vulnerability affects Linux kernel versions prior to the patch, and its severity underscores the importance of input validation in kernel interfaces.