CVE-2025-68236

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68236", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.258Z", "datePublished": "2025-12-16T14:08:30.224Z", "dateUpdated": "2026-10-30T12:23:10.538Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:10.538Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)\n\nAccording to UFS specifications, the power-off sequence for a UFS device\nincludes:\n\n - Sending an SSU command with Power_Condition=3 and await a response.\n\n - Asserting RST_N low.\n\n - Turning off REF_CLK.\n\n - Turning off VCC.\n\n - Turning off VCCQ/VCCQ2.\n\nAs part of ufs shutdown, after the SSU command completion, asserting\nhardware reset (HWRST) triggers the device firmware to wake up and\nexecute its reset routine. This routine initializes hardware blocks and\ntakes a few milliseconds to complete. During this time, the ICCQ draws a\nlarge current.\n\nThis large ICCQ current may cause issues for the regulator which is\nsupplying power to UFS, because the turn off request from UFS driver to\nthe regulator framework will be immediately followed by low power\nmode(LPM) request by regulator framework. This is done by framework\nbecause UFS which is the only client is requesting for disable. So if\nthe rail is still in the process of shutting down while ICCQ exceeds LPM\ncurrent thresholds, and LPM mode is activated in hardware during this\nstate, it may trigger an overcurrent protection (OCP) fault in the\nregulator.\n\nTo prevent this, a 10ms delay is added after asserting HWRST. This\nallows the reset operation to complete while power rails remain active\nand in high-power mode.\n\nCurrently there is no way for Host to query whether the reset is\ncompleted or not and hence this the delay is based on experiments with\nQualcomm UFS controllers across multiple UFS vendors."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/host/ufs-qcom.c"], "versions": [{"version": "b61d0414136853fc38898829cde837ce5d691a9a", "lessThan": "dd52d72f2bd727ca60c1bc9820a307b70e2154ec", "status": "affected", "versionType": "git"}, {"version": "b61d0414136853fc38898829cde837ce5d691a9a", "lessThan": "1c963811b0824d0f51aabd394986589a2126f341", "status": "affected", "versionType": "git"}, {"version": "b61d0414136853fc38898829cde837ce5d691a9a", "lessThan": "0c2619d1da8bd3d18524d69f12571a8cd7362833", "status": "affected", "versionType": "git"}, {"version": "b61d0414136853fc38898829cde837ce5d691a9a", "lessThan": "b712f234a74c1f5ce70b5d7aec3fc2499c258141", "status": "affected", "versionType": "git"}, {"version": "b61d0414136853fc38898829cde837ce5d691a9a", "lessThan": "5127be409c6c3815c4a7d8f6d88043e44f9b9543", "status": "affected", "versionType": "git"}, {"version": "82783759e88beee69b710806e45acbb2fc589801", "status": "affected", "versionType": "git"}, {"version": "5.10.219", "lessThan": "5.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/host/ufs-qcom.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.10", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.17.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.219"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dd52d72f2bd727ca60c1bc9820a307b70e2154ec"}, {"url": "https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341"}, {"url": "https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833"}, {"url": "https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141"}, {"url": "https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543"}], "title": "scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/ufs/host/ufs-qcom.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dd52d72f2bd727ca60c1bc9820a307b70e2154ec", "status": "affected", "version": "b61d0414136853fc38898829cde837ce5d691a9a", "versionType": "git"}, {"lessThan": "1c963811b0824d0f51aabd394986589a2126f341", "status": "affected", "version": "b61d0414136853fc38898829cde837ce5d691a9a", "versionType": "git"}, {"lessThan": "0c2619d1da8bd3d18524d69f12571a8cd7362833", "status": "affected", "version": "b61d0414136853fc38898829cde837ce5d691a9a", "versionType": "git"}, {"lessThan": "b712f234a74c1f5ce70b5d7aec3fc2499c258141", "status": "affected", "version": "b61d0414136853fc38898829cde837ce5d691a9a", "versionType": "git"}, {"lessThan": "5127be409c6c3815c4a7d8f6d88043e44f9b9543", "status": "affected", "version": "b61d0414136853fc38898829cde837ce5d691a9a", "versionType": "git"}, {"status": "affected", "version": "82783759e88beee69b710806e45acbb2fc589801", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.219", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/ufs/host/ufs-qcom.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)\n\nAccording to UFS specifications, the power-off sequence for a UFS device\nincludes:\n\n - Sending an SSU command with Power_Condition=3 and await a response.\n\n - Asserting RST_N low.\n\n - Turning off REF_CLK.\n\n - Turning off VCC.\n\n - Turning off VCCQ/VCCQ2.\n\nAs part of ufs shutdown, after the SSU command completion, asserting\nhardware reset (HWRST) triggers the device firmware to wake up and\nexecute its reset routine. This routine initializes hardware blocks and\ntakes a few milliseconds to complete. During this time, the ICCQ draws a\nlarge current.\n\nThis large ICCQ current may cause issues for the regulator which is\nsupplying power to UFS, because the turn off request from UFS driver to\nthe regulator framework will be immediately followed by low power\nmode(LPM) request by regulator framework. This is done by framework\nbecause UFS which is the only client is requesting for disable. So if\nthe rail is still in the process of shutting down while ICCQ exceeds LPM\ncurrent thresholds, and LPM mode is activated in hardware during this\nstate, it may trigger an overcurrent protection (OCP) fault in the\nregulator.\n\nTo prevent this, a 10ms delay is added after asserting HWRST. This\nallows the reset operation to complete while power rails remain active\nand in high-power mode.\n\nCurrently there is no way for Host to query whether the reset is\ncompleted or not and hence this the delay is based on experiments with\nQualcomm UFS controllers across multiple UFS vendors."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: ufs: ufs-qcom: Solucionar problema de OCP de UFS durante el apagado de UFS (PC=3)\n\nSeg\u00fan las especificaciones de UFS, la secuencia de apagado para un dispositivo UFS incluye:\n\n - Enviar un comando SSU con Power_Condition=3 y esperar una respuesta.\n\n - Poner RST_N en bajo.\n\n - Apagar REF_CLK.\n\n - Apagar VCC.\n\n - Apagar VCCQ/VCCQ2.\n\nComo parte del apagado de UFS, despu\u00e9s de la finalizaci\u00f3n del comando SSU, la activaci\u00f3n del reinicio de hardware (HWRST) activa el firmware del dispositivo para que se active y ejecute su rutina de reinicio. Esta rutina inicializa los bloques de hardware y tarda unos pocos milisegundos en completarse. Durante este tiempo, el ICCQ consume una gran corriente.\n\nEsta gran corriente de ICCQ puede causar problemas para el regulador que est\u00e1 suministrando energ\u00eda a UFS, porque la solicitud de apagado del controlador UFS al framework del regulador ser\u00e1 inmediatamente seguida por una solicitud de modo de baja potencia (LPM) por parte del framework del regulador. Esto lo hace el framework porque UFS, que es el \u00fanico cliente, est\u00e1 solicitando la desactivaci\u00f3n. Entonces, si el carril todav\u00eda est\u00e1 en proceso de apagado mientras el ICCQ excede los umbrales de corriente de LPM, y el modo LPM se activa en el hardware durante este estado, puede activar una falla de protecci\u00f3n contra sobrecorriente (OCP) en el regulador.\n\nPara evitar esto, se a\u00f1ade un retardo de 10ms despu\u00e9s de activar HWRST. Esto permite que la operaci\u00f3n de reinicio se complete mientras los carriles de alimentaci\u00f3n permanecen activos y en modo de alta potencia.\n\nActualmente no hay forma de que el Host consulte si el reinicio se ha completado o no y, por lo tanto, este retardo se basa en experimentos con controladores UFS de Qualcomm en m\u00faltiples proveedores de UFS."}], "id": "CVE-2025-68236", "lastModified": "2026-10-30T13:18:19.840", "metrics": {}, "published": "2025-12-16T14:15:58.640", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd52d72f2bd727ca60c1bc9820a307b70e2154ec"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)", "id": "2422752", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422752"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-68236", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68236\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68236\nhttps://lore.kernel.org/linux-cve-announce/2025121635-CVE-2025-68236-d2fe@gregkh/T"], "threat_severity": "Moderate"}

{}