CVE-2025-71196: phy: stm32-usphyc: Fix off by one in probe()
In the Linux kernel, the following vulnerability has been resolved:
phy: stm32-usphyc: Fix off by one in probe()
The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems using the STM32 USB PHY driver are relevant. Exploitation requires a device-tree PHY index equal to the number of available PHY entries, causing an out-of-bounds access during driver probe.
Is a standard device-tree configuration likely to trigger the issue?
The index is sourced from the device tree and is described as trusted data that is unlikely to be wrong. The issue is therefore unlikely to be triggered by a correct device-tree configuration.
What can be done if the fix cannot be applied immediately?
Ensure device-tree PHY index values are strictly less than the configured number of PHY entries. In particular, do not use an index equal to usbphyc->nphys.