CVE-2025-71193

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71193", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-31T11:36:51.189Z", "datePublished": "2026-02-04T16:04:14.514Z", "dateUpdated": "2026-10-30T12:23:31.285Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:31.285Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: qcom-qusb2: Fix NULL pointer dereference on early suspend\n\nEnabling runtime PM before attaching the QPHY instance as driver data\ncan lead to a NULL pointer dereference in runtime PM callbacks that\nexpect valid driver data. There is a small window where the suspend\ncallback may run after PM runtime enabling and before runtime forbid.\nThis causes a sporadic crash during boot:\n\n```\nUnable to handle kernel NULL pointer dereference at virtual address 00000000000000a1\n[...]\nCPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT\nWorkqueue: pm pm_runtime_work\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2]\nlr : pm_generic_runtime_suspend+0x2c/0x44\n[...]\n```\n\nAttach the QPHY instance as driver data before enabling runtime PM to\nprevent NULL pointer dereference in runtime PM callbacks.\n\nReorder pm_runtime_enable() and pm_runtime_forbid() to prevent a\nshort window where an unnecessary runtime suspend can occur.\n\nUse the devres-managed version to ensure PM runtime is symmetrically\ndisabled during driver removal for proper cleanup."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/phy/qualcomm/phy-qcom-qusb2.c"], "versions": [{"version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "lessThan": "f8a30ff99ae45d368737993961f7c334c76af5fa", "status": "affected", "versionType": "git"}, {"version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "lessThan": "beba460a299150b5d8dcbe3474a8f4bdf0205180", "status": "affected", "versionType": "git"}, {"version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "lessThan": "d50a9b7fd07296a1ab81c49ceba14cae3d31df86", "status": "affected", "versionType": "git"}, {"version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "lessThan": "4ac15caa27ff842b068a54f1c6a8ff8b31f658e7", "status": "affected", "versionType": "git"}, {"version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "lessThan": "1ca52c0983c34fca506921791202ed5bdafd5306", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/phy/qualcomm/phy-qcom-qusb2.c"], "versions": [{"version": "4.17", "status": "affected"}, {"version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.122", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.67", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.7", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.122"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f8a30ff99ae45d368737993961f7c334c76af5fa"}, {"url": "https://git.kernel.org/stable/c/beba460a299150b5d8dcbe3474a8f4bdf0205180"}, {"url": "https://git.kernel.org/stable/c/d50a9b7fd07296a1ab81c49ceba14cae3d31df86"}, {"url": "https://git.kernel.org/stable/c/4ac15caa27ff842b068a54f1c6a8ff8b31f658e7"}, {"url": "https://git.kernel.org/stable/c/1ca52c0983c34fca506921791202ed5bdafd5306"}], "title": "phy: qcom-qusb2: Fix NULL pointer dereference on early suspend", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/phy/qualcomm/phy-qcom-qusb2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f8a30ff99ae45d368737993961f7c334c76af5fa", "status": "affected", "version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "versionType": "git"}, {"lessThan": "beba460a299150b5d8dcbe3474a8f4bdf0205180", "status": "affected", "version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "versionType": "git"}, {"lessThan": "d50a9b7fd07296a1ab81c49ceba14cae3d31df86", "status": "affected", "version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "versionType": "git"}, {"lessThan": "4ac15caa27ff842b068a54f1c6a8ff8b31f658e7", "status": "affected", "version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "versionType": "git"}, {"lessThan": "1ca52c0983c34fca506921791202ed5bdafd5306", "status": "affected", "version": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/phy/qualcomm/phy-qcom-qusb2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"lessThan": "4.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.122", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.67", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: qcom-qusb2: Fix NULL pointer dereference on early suspend\n\nEnabling runtime PM before attaching the QPHY instance as driver data\ncan lead to a NULL pointer dereference in runtime PM callbacks that\nexpect valid driver data. There is a small window where the suspend\ncallback may run after PM runtime enabling and before runtime forbid.\nThis causes a sporadic crash during boot:\n\n```\nUnable to handle kernel NULL pointer dereference at virtual address 00000000000000a1\n[...]\nCPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT\nWorkqueue: pm pm_runtime_work\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2]\nlr : pm_generic_runtime_suspend+0x2c/0x44\n[...]\n```\n\nAttach the QPHY instance as driver data before enabling runtime PM to\nprevent NULL pointer dereference in runtime PM callbacks.\n\nReorder pm_runtime_enable() and pm_runtime_forbid() to prevent a\nshort window where an unnecessary runtime suspend can occur.\n\nUse the devres-managed version to ensure PM runtime is symmetrically\ndisabled during driver removal for proper cleanup."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nphy: qcom-qusb2: Correcci\u00f3n de desreferencia de puntero NULL en suspensi\u00f3n temprana\n\nHabilitar PM en tiempo de ejecuci\u00f3n antes de adjuntar la instancia QPHY como datos del controlador puede llevar a una desreferencia de puntero NULL en las retrollamadas de PM en tiempo de ejecuci\u00f3n que esperan datos de controlador v\u00e1lidos. Hay una peque\u00f1a ventana donde la retrollamada de suspensi\u00f3n puede ejecutarse despu\u00e9s de la habilitaci\u00f3n de PM en tiempo de ejecuci\u00f3n y antes de la prohibici\u00f3n en tiempo de ejecuci\u00f3n. Esto causa un fallo espor\u00e1dico durante el arranque:\n\n```\nUnable to handle kernel NULL pointer dereference at virtual address 00000000000000a1\n[...]\nCPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT\nWorkqueue: pm pm_runtime_work\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2]\nlr : pm_generic_runtime_suspend+0x2c/0x44\n[...]\n```\n\nAdjuntar la instancia QPHY como datos del controlador antes de habilitar PM en tiempo de ejecuci\u00f3n para prevenir la desreferencia de puntero NULL en las retrollamadas de PM en tiempo de ejecuci\u00f3n.\n\nReordenar pm_runtime_enable() y pm_runtime_forbid() para prevenir una ventana corta donde puede ocurrir una suspensi\u00f3n en tiempo de ejecuci\u00f3n innecesaria.\n\nUsar la versi\u00f3n gestionada por devres para asegurar que PM en tiempo de ejecuci\u00f3n se deshabilite sim\u00e9tricamente durante la eliminaci\u00f3n del controlador para una limpieza adecuada."}], "id": "CVE-2025-71193", "lastModified": "2026-10-30T13:18:26.610", "metrics": {}, "published": "2026-02-04T17:16:11.193", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ca52c0983c34fca506921791202ed5bdafd5306"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ac15caa27ff842b068a54f1c6a8ff8b31f658e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/beba460a299150b5d8dcbe3474a8f4bdf0205180"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d50a9b7fd07296a1ab81c49ceba14cae3d31df86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8a30ff99ae45d368737993961f7c334c76af5fa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend", "id": "2436761", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436761"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-71193", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-71193\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71193\nhttps://lore.kernel.org/linux-cve-announce/2026020439-CVE-2025-71193-288d@gregkh/T"], "threat_severity": "Low"}

{}