CVE-2025-71094 net: usb: asix: validate PHY address before use

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Vulnerabilities Identified in USB Network Drivers Two new vulnerabilities have been reported in USB network drivers affecting devices using asix and aqc111 chipsets. CVE-2025-71094, published on January 13, 2026, addresses issues with PHY address validation, while CVE-2025-38153, published on July 3, 2025, focuses on error handling in usbnet read calls. Both vulnerabilities could impact the stability and security of affected systems. 4 sources 41