CVE-2025-40120 (GCVE-0-2025-40120)
Vulnerability from cvelistv5
Published
2025-11-12 10:23
Modified
2025-11-12 10:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM (autosuspend) for AX88772* in bind. usbnet enables runtime PM (autosuspend) by default, so disabling it via the usb_driver flag is ineffective. On AX88772B, autosuspend shows no measurable power saving with current driver (no link partner, admin up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering the PHY off on admin-down, not from USB autosuspend. The real hazard is that with runtime PM enabled, ndo_open() (under RTNL) may synchronously trigger autoresume (usb_autopm_get_interface()) into asix_resume() while the USB PM lock is held. Resume paths then invoke phylink/phylib and MDIO, which also expect RTNL, leading to possible deadlocks or PM lock vs MDIO wake issues. To avoid this, keep the device runtime-PM active by taking a usage reference in ax88772_bind() and dropping it in unbind(). A non-zero PM usage count blocks runtime suspend regardless of userspace policy (.../power/control - pm_runtime_allow/forbid), making this approach robust against sysfs overrides. Holding a runtime-PM usage ref does not affect system-wide suspend; system sleep/resume callbacks continue to run as before.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4a2c7217cd5a87e85ceb761e307b030fe6db4805
Version: 4a2c7217cd5a87e85ceb761e307b030fe6db4805
Version: 4a2c7217cd5a87e85ceb761e307b030fe6db4805
Version: 4a2c7217cd5a87e85ceb761e307b030fe6db4805
Version: 4a2c7217cd5a87e85ceb761e307b030fe6db4805
Version: 4a2c7217cd5a87e85ceb761e307b030fe6db4805
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/asix_devices.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "71a0ba7fdaf8d035426912a4ed7bf1738a81010c",
              "status": "affected",
              "version": "4a2c7217cd5a87e85ceb761e307b030fe6db4805",
              "versionType": "git"
            },
            {
              "lessThan": "3e96cd27ff1a004d84908c1b6cc68ac60913874e",
              "status": "affected",
              "version": "4a2c7217cd5a87e85ceb761e307b030fe6db4805",
              "versionType": "git"
            },
            {
              "lessThan": "724a9db84188f80ef60b1f21cc7b4e9c84e0cb64",
              "status": "affected",
              "version": "4a2c7217cd5a87e85ceb761e307b030fe6db4805",
              "versionType": "git"
            },
            {
              "lessThan": "1534517300e12f2930b6ff477b8820ff658afd11",
              "status": "affected",
              "version": "4a2c7217cd5a87e85ceb761e307b030fe6db4805",
              "versionType": "git"
            },
            {
              "lessThan": "9d8bcaf6fae1bd82bc27ec09a2694497e6f6c4b4",
              "status": "affected",
              "version": "4a2c7217cd5a87e85ceb761e307b030fe6db4805",
              "versionType": "git"
            },
            {
              "lessThan": "3d3c4cd5c62f24bb3cb4511b7a95df707635e00a",
              "status": "affected",
              "version": "4a2c7217cd5a87e85ceb761e307b030fe6db4805",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/asix_devices.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18-rc1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock\n\nPrevent USB runtime PM (autosuspend) for AX88772* in bind.\n\nusbnet enables runtime PM (autosuspend) by default, so disabling it via\nthe usb_driver flag is ineffective. On AX88772B, autosuspend shows no\nmeasurable power saving with current driver (no link partner, admin\nup/down). The ~0.453 W -\u003e ~0.248 W drop on v6.1 comes from phylib powering\nthe PHY off on admin-down, not from USB autosuspend.\n\nThe real hazard is that with runtime PM enabled, ndo_open() (under RTNL)\nmay synchronously trigger autoresume (usb_autopm_get_interface()) into\nasix_resume() while the USB PM lock is held. Resume paths then invoke\nphylink/phylib and MDIO, which also expect RTNL, leading to possible\ndeadlocks or PM lock vs MDIO wake issues.\n\nTo avoid this, keep the device runtime-PM active by taking a usage\nreference in ax88772_bind() and dropping it in unbind(). A non-zero PM\nusage count blocks runtime suspend regardless of userspace policy\n(.../power/control - pm_runtime_allow/forbid), making this approach\nrobust against sysfs overrides.\n\nHolding a runtime-PM usage ref does not affect system-wide suspend;\nsystem sleep/resume callbacks continue to run as before."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-12T10:23:18.726Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/71a0ba7fdaf8d035426912a4ed7bf1738a81010c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e96cd27ff1a004d84908c1b6cc68ac60913874e"
        },
        {
          "url": "https://git.kernel.org/stable/c/724a9db84188f80ef60b1f21cc7b4e9c84e0cb64"
        },
        {
          "url": "https://git.kernel.org/stable/c/1534517300e12f2930b6ff477b8820ff658afd11"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d8bcaf6fae1bd82bc27ec09a2694497e6f6c4b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d3c4cd5c62f24bb3cb4511b7a95df707635e00a"
        }
      ],
      "title": "net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40120",
    "datePublished": "2025-11-12T10:23:18.726Z",
    "dateReserved": "2025-04-16T07:20:57.169Z",
    "dateUpdated": "2025-11-12T10:23:18.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40120\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-12T11:15:41.430\",\"lastModified\":\"2025-11-12T16:19:12.850\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock\\n\\nPrevent USB runtime PM (autosuspend) for AX88772* in bind.\\n\\nusbnet enables runtime PM (autosuspend) by default, so disabling it via\\nthe usb_driver flag is ineffective. On AX88772B, autosuspend shows no\\nmeasurable power saving with current driver (no link partner, admin\\nup/down). The ~0.453 W -\u003e ~0.248 W drop on v6.1 comes from phylib powering\\nthe PHY off on admin-down, not from USB autosuspend.\\n\\nThe real hazard is that with runtime PM enabled, ndo_open() (under RTNL)\\nmay synchronously trigger autoresume (usb_autopm_get_interface()) into\\nasix_resume() while the USB PM lock is held. Resume paths then invoke\\nphylink/phylib and MDIO, which also expect RTNL, leading to possible\\ndeadlocks or PM lock vs MDIO wake issues.\\n\\nTo avoid this, keep the device runtime-PM active by taking a usage\\nreference in ax88772_bind() and dropping it in unbind(). A non-zero PM\\nusage count blocks runtime suspend regardless of userspace policy\\n(.../power/control - pm_runtime_allow/forbid), making this approach\\nrobust against sysfs overrides.\\n\\nHolding a runtime-PM usage ref does not affect system-wide suspend;\\nsystem sleep/resume callbacks continue to run as before.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1534517300e12f2930b6ff477b8820ff658afd11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3d3c4cd5c62f24bb3cb4511b7a95df707635e00a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3e96cd27ff1a004d84908c1b6cc68ac60913874e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/71a0ba7fdaf8d035426912a4ed7bf1738a81010c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/724a9db84188f80ef60b1f21cc7b4e9c84e0cb64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d8bcaf6fae1bd82bc27ec09a2694497e6f6c4b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.