CVE-2025-22011

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22011
In the Linux kernel, the following vulnerability has been resolved: ARM: dts: bcm2711: Fix xHCI power-domain During s2idle tests on the Raspberry CM4 the VPU firmware always crashes on xHCI power-domain resume: root@raspberrypi:/sys/power# echo freeze > state [ 70.724347] xhci_suspend finished [ 70.727730] xhci_plat_suspend finished [ 70.755624] bcm2835-power bcm2835-power: Power grafx off [ 70.761127] USB: Set power to 0 [ 74.653040] USB: Failed to set power to 1 (-110) This seems to be caused because of the mixed usage of raspberrypi-power and bcm2835-power at the same time. So avoid the usage of the VPU firmware power-domain driver, which prevents the VPU crash.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/393947e06867923d4c2be380d46efd03407a8ce2 Patch
https://git.kernel.org/stable/c/b8a47aa0b3df701d0fc41b3caf78d00571776be0 Patch
https://git.kernel.org/stable/c/f44fa354a0715577ca32b085f6f60bcf32c748dd Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*
History

10 Apr 2025, 13:10

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/393947e06867923d4c2be380d46efd03407a8ce2 - () https://git.kernel.org/stable/c/393947e06867923d4c2be380d46efd03407a8ce2 - Patch
References () https://git.kernel.org/stable/c/b8a47aa0b3df701d0fc41b3caf78d00571776be0 - () https://git.kernel.org/stable/c/b8a47aa0b3df701d0fc41b3caf78d00571776be0 - Patch
References () https://git.kernel.org/stable/c/f44fa354a0715577ca32b085f6f60bcf32c748dd - () https://git.kernel.org/stable/c/f44fa354a0715577ca32b085f6f60bcf32c748dd - Patch
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux

08 Apr 2025, 18:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ARM: dts: bcm2711: Reparar xHCI power-domain Durante las pruebas s2idle en Raspberry CM4, el firmware de la VPU siempre falla en xHCI power-domain resume: root@raspberrypi:/sys/power# echo freeze > state [ 70.724347] xhci_suspend finished [ 70.727730] xhci_plat_suspend finished [ 70.755624] bcm2835-power bcm2835-power: Apagar grafx [ 70.761127] USB: Establecer la energía en 0 [ 74.653040] USB: No se pudo establecer la energía en 1 (-110) Esto parece deberse al uso mixto de raspberrypi-power y bcm2835-power al mismo tiempo. Por lo tanto, evite el uso del controlador de dominio de energía del firmware VPU, lo que evita el bloqueo de la VPU.

08 Apr 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-08 09:15

Updated : 2025-04-10 13:10

NVD link : CVE-2025-22011

Mitre link : CVE-2025-22011

CVE.ORG link : CVE-2025-22011

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo