{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.16.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: phy: transfer phy_config_inband() locking responsibility to phylink  Problem description ===================  Lockdep reports a possible circular locking dependency (AB/BA) between \u0026pl-\u003estate_mutex and \u0026phy-\u003elock, as follows.  phylink_resolve() // acquires \u0026pl-\u003estate_mutex -\u003e phylink_major_config()    -\u003e phy_config_inband() // acquires \u0026pl-\u003ephydev-\u003elock  whereas all the other call sites where \u0026pl-\u003estate_mutex and \u0026pl-\u003ephydev-\u003elock have the locking scheme reversed. Everywhere else, \u0026pl-\u003ephydev-\u003elock is acquired at the top level, and \u0026pl-\u003estate_mutex at the lower level. A clear example is phylink_bringup_phy().  The outlier is the newly introduced phy_config_inband() and the existing lock order is the correct one. To understand why it cannot be the other way around, it is sufficient to consider phylink_phy_change(), phylink's callback from the PHY device's phy-\u003ephy_link_change() virtual method, invoked by the PHY state machine.  phy_link_up() and phy_link_down(), the (indirect) callers of phylink_phy_change(), are called with \u0026phydev-\u003elock acquired. Then phylink_phy_change() acquires its own \u0026pl-\u003estate_mutex, to serialize changes made to its pl-\u003ephy_state and pl-\u003elink_config. So all other instances of \u0026pl-\u003estate_mutex and \u0026phydev-\u003elock must be consistent with this order.  Problem impact ==============  I think the kernel runs a serious deadlock risk if an existing phylink_resolve() thread, which results in a phy_config_inband() call, is concurrent with a phy_link_up() or phy_link_down() call, which will deadlock on \u0026pl-\u003estate_mutex in phylink_phy_change(). Practically speaking, the impact may be limited by the slow speed of the medium auto-negotiation protocol, which makes it unlikely for the current state to still be unresolved when a new one is detected, but I think the problem is there. Nonetheless, the problem was discovered using lockdep.  Proposed solution =================  Practically speaking, the phy_config_inband() requirement of having phydev-\u003elock acquired must transfer to the caller (phylink is the only caller). There, it must bubble up until immediately before \u0026pl-\u003estate_mutex is acquired, for the cases where that takes place.  Solution details, considerations, notes =======================================  This is the phy_config_inband() call graph:                            sfp_upstream_ops :: connect_phy()                           |                           v                           phylink_sfp_connect_phy()                           |                           v                           phylink_sfp_config_phy()                           |                           |   sfp_upstream_ops :: module_insert()                           |   |                           |   v                           |   phylink_sfp_module_insert()                           |   |                           |   |   sfp_upstream_ops :: module_start()                           |   |   |                           |   |   v                           |   |   phylink_sfp_module_start()                           |   |   |                           |   v   v                           |   phylink_sfp_config_optical()  phylink_start()          |   |    |   phylink_resume()   v   v    |   |  phylink_sfp_set_config()    |   |  |    v   v  v  phylink_mac_initial_config()    |   phylink_resolve()    |   |  phylink_ethtool_ksettings_set()    v   v  v    phylink_major_config()             |             v     phy_config_inband()  phylink_major_config() caller #1, phylink_mac_initial_config(), does not acquire \u0026pl-\u003estate_mutex nor do its callers. It must acquire \u0026pl-\u003ephydev-\u003elock prior to calling phylink_major_config().  phylink_major_config() caller #2, phylink_resolve() acquires \u0026pl-\u003estate_mutex, thus also needs to acquire \u0026pl-\u003ephydev-\u003elock.  phylink_major_config() caller #3, phylink_ethtool_ksettings_set(), is completely uninteresting, because it only call ---truncated---",
  "id": "DEBIAN-CVE-2025-39915",
  "modified": "2026-09-01T19:48:50.042894437Z",
  "published": "2025-10-01T08:15:34.647Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2025-39915"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2025-39915"
  ]
}