The vulnerability lies in the Linux kernel’s handling of power management operations for MDIO bus‑controlled PHYs that are managed via phylink. During a suspend event the code mistakenly does not stop the PHY state machine, which can leave the device in a running state. When the system is later resumed, the kernel’s resume function attempts to restart the PHY, but the device remains in an inconsistent state and a WARN_ON triggers. This flaw can lead to link flapping, misreported link status, or in extreme cases a kernel panic if the state machine is restarted while the device is still operating.

System administrators using Linux kernels that include phylink support—especially kernel 6.15 releases and later—are affected. The flaw touches a large set of network drivers that rely on MDIO bus power‑management, including atheros ag71xx, microchip sparx5/lan966x, freescale dpaa2/dpaa/enetc, marvell mvpp2/mvneta/prestera, mediatek mtk_eth_soc, and others listed in the advisory. Any deployment that uses these drivers with phylink-controlled PHYs is potentially exposed, regardless of distribution or vendor.

The CVSS base score of 5.5 reflects a moderate severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The issue is not currently in the CISA KEV catalog. It is a local “bug” rather than an attack vector; an attacker would need to trigger a power‑management cycle or perform a reboot, making practical exploitation difficult. Mitigating the risk is primarily a matter of applying the upstream patch rather than tracking external threat activity.