CVE-2025-37945

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY

DSA has 2 kinds of drivers:

1. Those who call dsa_switch_suspend() and dsa_switch_resume() from

their device PM ops: qca8k-8xxx, bcm_sf2, microchip ksz

2. Those who don't: all others. The above methods should be optional.

For type 1, dsa_switch_suspend() calls dsa_user_suspend() -> phylink_stop(),

and dsa_switch_resume() calls dsa_user_resume() -> phylink_start().

These seem good candidates for setting mac_managed_pm = true because

that is essentially its definition [1], but that does not seem to be the

biggest problem for now, and is not what this change focuses on.

Talking strictly about the 2nd category of DSA drivers here (which

do not have MAC managed PM, meaning that for their attached PHYs,

mdio_bus_phy_suspend() and mdio_bus_phy_resume() should run in full),

I have noticed that the following warning from mdio_bus_phy_

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References