# CVE-2025-39905: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver CVE-2025-39905 is fixed in 31 products on 1 platform, first by DEBIAN-CVE-2025-39905, released October 1, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-39905 - Priority: High - CVSS: 7.8 (Moderate) - EPSS: 0.0011 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 1, 2025 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39905 ## Description In the Linux kernel, the following vulnerability has been resolved: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Currently phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_phy() calls which modify pl->phydev by relying on pl->state_mutex. The problem is that in phylink_resolve(), pl->state_mutex is in a lock inversion state with pl->phydev->lock. So pl->phydev->lock needs to be acquired prior to pl->state_mutex. But that requires dereferencing pl->phydev in the first place, and without pl->state_mutex, that is racy. Hence the reason for the extra lock. Currently it is redundant, but it will serve a functional purpose once mutex_lock(&phy->lock) will be moved outside of the mutex_lock(&pl->state_mutex) section. Another alternative considered would have been to let phylink_resolve() acquire the rtnl_mutex, which is also held when phylink_bringup_phy() and phylink_disconnect_phy() are called. But since phylink_disconnect_phy() runs under rtnl_lock(), it would deadlock with phylink_resolve() when calling flush_work(&pl->resolve). Additionally, it would have been undesirable because it would have unnecessarily blocked many other call paths as well in the entire kernel, so the smaller-scoped lock was preferred. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | kernel RHEL 10 | 6.12.0-124.27.1.el10_1 | [RHSA-2026:0453](https://patchblox.com/security/data/fix/linux/rhsa-2026-0453.md) | Dec 16, 2025 | | Linux | kernel ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel rocky 10 | 0:6.12.0-124.27.1.el10_1 | [RLSA-2026:0453](https://patchblox.com/security/data/fix/linux/rlsa-2026-0453.md) | Jan 17, 2026 | | Linux | kernel-abi-stablelists almalinux 10 | 6.12.0-124.27.1.el10_1 | [ALSA-2026:0453](https://patchblox.com/security/data/fix/linux/alsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-abi-stablelists ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-core ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-cross-headers ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-debug ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-debug-core ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-debug-devel ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-debug-devel-matched ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-debug-modules ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-debug-modules-core ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-debug-modules-extra ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-debug-uki-virt ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-devel ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-devel-matched ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-doc almalinux 10 | 6.12.0-124.27.1.el10_1 | [ALSA-2026:0453](https://patchblox.com/security/data/fix/linux/alsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-doc ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-headers ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-modules ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-modules-core ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-modules-extra ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-modules-extra-matched ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-tools ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-tools-libs ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-tools-libs-devel ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-uki-virt ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | kernel-uki-virt-addons ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | libperf ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | linux Debian 14 | 6.16.8-1 | [DEBIAN-CVE-2025-39905](https://patchblox.com/security/data/fix/linux/debian-cve-2025-39905.md) | Oct 1, 2025 | | Linux | perf ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | python3-perf ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | rtla ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | | Linux | rv ol 10 | 0:6.12.0-124.27.1.el10_1 | [ELSA-2026-0453](https://patchblox.com/security/data/fix/linux/elsa-2026-0453.md) | Jan 12, 2026 | --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.