{"cve":"CVE-2025-39805","nvd":{"published":"2025-09-16T13:15:50.750","modified":"2026-10-19T21:10:00.160","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix unregister_netdev call order in macb_remove()\n\nWhen removing a macb device, the driver calls phy_exit() before\nunregister_netdev(). This leads to a WARN from kernfs:\n\n  ------------[ cut here ]------------\n  kernfs: can not remove 'attached_dev', no directory\n  WARNING: CPU: 1 PID: 27146 at fs/kernfs/dir.c:1683\n  Call trace:\n    kernfs_remove_by_name_ns+0xd8/0xf0\n    sysfs_remove_link+0x24/0x58\n    phy_detach+0x5c/0x168\n    phy_disconnect+0x4c/0x70\n    phylink_disconnect_phy+0x6c/0xc0 [phylink]\n    macb_close+0x6c/0x170 [macb]\n    ...\n    macb_remove+0x60/0x168 [macb]\n    platform_remove+0x5c/0x80\n    ...\n\nThe warning happens because the PHY is being exited while the netdev\nis still registered. The correct order is to unregister the netdev\nbefore shutting down the PHY and cleaning up the MDIO bus.\n\nFix this by moving unregister_netdev() ahead of phy_exit() in\nmacb_remove().","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/01b9128c5db1b470575d07b05b67ffa3cb02ebf1","https://git.kernel.org/stable/c/2b9719ccad38dffad7dbdd2f39896f723f9b9011","https://git.kernel.org/stable/c/7351782f2fc8ac31ced52e3d4e6fa120f819a7ab","https://git.kernel.org/stable/c/775fe690fd4a3337ad2115de2adb41b227d4dae7","https://git.kernel.org/stable/c/ff0d3bad32108b57265e5b48f15327549af771d3"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2025-39805","score":0.00159,"percentile":0.05016,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}