VulnerabilityPublished 4 Feb 2026Updated 22 Aug 2026

CVE-2025-71196: Linux kernel · phy: stm32-usphyc: Fix off by one in probe()

Affects Linux kernelSource GCVE Database

Not known to be exploited · fixed in 5.15.0-1105.112~20.04.1 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 11:07 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 5.15.0-1105.112~20.04.1, 5.15.0-1110.119~20.04.1, 5.15.0-1106.115~20.04.1 +59

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
Ubuntu 25.10linux`pkg:deb/ubuntu/linux@6.17.0-40.40?arch=source&distro=questing`Other threats	Affected 6.14.0-15.15 – 6.17.0-40.40 20 affected builds	Fixed in–
Ubuntu 25.10linux-aws`pkg:deb/ubuntu/linux-aws@6.17.0-1019.19?arch=source&distro=questing`Other threats	Affected 6.14.0-1005.5 – 6.17.0-1019.19 17 affected builds	Fixed in–
Ubuntu 25.10linux-azure`pkg:deb/ubuntu/linux-azure@6.17.0-1020.20?arch=source&distro=questing`Other threats	Affected 6.14.0-1004.4 – 6.17.0-1020.20 16 affected builds	Fixed in–
Ubuntu 25.10linux-azure-fde`pkg:deb/ubuntu/linux-azure-fde@6.17.0-1017.17?arch=source&distro=questing`Other threats	Affected 6.17.0-1003.3 – 6.17.0-1017.17 10 affected builds	Fixed in–
Ubuntu 25.10linux-gcp`pkg:deb/ubuntu/linux-gcp@6.17.0-1020.22?arch=source&distro=questing`Other threats	Affected 6.14.0-1006.6 – 6.17.0-1020.22 17 affected builds	Fixed in–
Ubuntu 25.10linux-oracle`pkg:deb/ubuntu/linux-oracle@6.17.0-1018.18?arch=source&distro=questing`Other threats	Affected 6.14.0-1005.5 – 6.17.0-1018.18 16 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch correcting the off-by-one error is available and included in official Ubuntu Linux kernel updates for versions prior to 5.15.0-1105.112~20.04.1 and related builds. Users should apply the latest kernel updates from their distribution repositories and reboot their systems to activate the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigation steps are necessary beyond applying the official patches.

Description

A medium severity vulnerability (CVE-2025-71196) in the Linux kernel's stm32-usphyc PHY driver was fixed by correcting an off-by-one error in the probe() function. The issue involved an 'index' variable used to access an array, which could go out of bounds if equal to the array size. The vulnerability was addressed by changing a boundary check from '>' to '>=' to prevent out-of-bounds access. This flaw originated from trusting device tree data, which is unlikely to be incorrect but still posed a risk. The fix is included in updated Linux kernel packages for Ubuntu 20.04 LTS and 22.04 LTS releases. Users are advised to apply the official patches and reboot systems to ensure remediation. No known exploits are reported in the wild.

Impact

An attacker could potentially exploit the off-by-one error to cause out-of-bounds memory access within the stm32-usphyc PHY driver in the Linux kernel. While the device tree data providing the index is trusted and unlikely to be maliciously crafted, the vulnerability could lead to memory corruption or system instability if triggered. No known exploits in the wild have been reported. The overall impact is considered medium severity due to the limited attack vector and the nature of the flaw.

Summary

The Linux kernel's stm32-usphyc PHY driver contained an off-by-one error in the probe() function where the 'index' variable, sourced from the device tree, was used as an index into the usbphyc->phys[] array. If 'index' equaled usbphyc->nphys, it resulted in an out-of-bounds array access. Although the device tree data is generally trusted and unlikely to be incorrect, this boundary condition was corrected by changing the comparison operator from '>' to '>=' to prevent potential memory access issues. This vulnerability was fixed in Linux kernel updates distributed by Ubuntu for various 5.15 kernel versions. The fix is part of broader kernel security updates addressing multiple subsystems. No active exploitation has been reported.

GCVE source: db.gcve.eu
OSV ID: UBUNTU-CVE-2025-71196
Osv Schema Version: 1.7.0
Ecosystems: Ubuntu:16.04:LTS, Ubuntu:18.04:LTS, Ubuntu:Pro:18.04:LTS, Ubuntu:Pro:20.04:LTS, Ubuntu:20.04:LTS, Ubuntu:Pro:FIPS-updates:20.04:LTS, Ubuntu:Pro:FIPS:20.04:LTS, Ubuntu:22.04:LTS, Ubuntu:Nvidia-BlueField:22.04:LTS, Ubuntu:Pro:FIPS-preview:22.04:LTS, Ubuntu:Pro:FIPS-updates:22.04:LTS, Ubuntu:Pro:Realtime:22.04:LTS, Ubuntu:24.04:LTS, Ubuntu:Nvidia-BlueField:24.04:LTS, Ubuntu:Pro:FIPS-updates:24.04:LTS, Ubuntu:Pro:Realtime:24.04:LTS, Ubuntu:25.10

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 22 Aug 2026, 22:01 UTC

Technical details

References

Community reviews

Related threats