FKIE_CVE-2025-68236

Vulnerability from fkie_nvd - Published: 2025-12-16 14:15 - Updated: 2026-10-30 13:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with Power_Condition=3 and await a response. - Asserting RST_N low. - Turning off REF_CLK. - Turning off VCC. - Turning off VCCQ/VCCQ2. As part of ufs shutdown, after the SSU command completion, asserting hardware reset (HWRST) triggers the device firmware to wake up and execute its reset routine. This routine initializes hardware blocks and takes a few milliseconds to complete. During this time, the ICCQ draws a large current. This large ICCQ current may cause issues for the regulator which is supplying power to UFS, because the turn off request from UFS driver to the regulator framework will be immediately followed by low power mode(LPM) request by regulator framework. This is done by framework because UFS which is the only client is requesting for disable. So if the rail is still in the process of shutting down while ICCQ exceeds LPM current thresholds, and LPM mode is activated in hardware during this state, it may trigger an overcurrent protection (OCP) fault in the regulator. To prevent this, a 10ms delay is added after asserting HWRST. This allows the reset operation to complete while power rails remain active and in high-power mode. Currently there is no way for Host to query whether the reset is completed or not and hence this the delay is based on experiments with Qualcomm UFS controllers across multiple UFS vendors.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd52d72f2bd727ca60c1bc9820a307b70e2154ec
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/host/ufs-qcom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd52d72f2bd727ca60c1bc9820a307b70e2154ec",
              "status": "affected",
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "versionType": "git"
            },
            {
              "lessThan": "1c963811b0824d0f51aabd394986589a2126f341",
              "status": "affected",
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "versionType": "git"
            },
            {
              "lessThan": "0c2619d1da8bd3d18524d69f12571a8cd7362833",
              "status": "affected",
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "versionType": "git"
            },
            {
              "lessThan": "b712f234a74c1f5ce70b5d7aec3fc2499c258141",
              "status": "affected",
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "versionType": "git"
            },
            {
              "lessThan": "5127be409c6c3815c4a7d8f6d88043e44f9b9543",
              "status": "affected",
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "82783759e88beee69b710806e45acbb2fc589801",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.219",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/host/ufs-qcom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)\n\nAccording to UFS specifications, the power-off sequence for a UFS device\nincludes:\n\n - Sending an SSU command with Power_Condition=3 and await a response.\n\n - Asserting RST_N low.\n\n - Turning off REF_CLK.\n\n - Turning off VCC.\n\n - Turning off VCCQ/VCCQ2.\n\nAs part of ufs shutdown, after the SSU command completion, asserting\nhardware reset (HWRST) triggers the device firmware to wake up and\nexecute its reset routine. This routine initializes hardware blocks and\ntakes a few milliseconds to complete. During this time, the ICCQ draws a\nlarge current.\n\nThis large ICCQ current may cause issues for the regulator which is\nsupplying power to UFS, because the turn off request from UFS driver to\nthe regulator framework will be immediately followed by low power\nmode(LPM) request by regulator framework. This is done by framework\nbecause UFS which is the only client is requesting for disable. So if\nthe rail is still in the process of shutting down while ICCQ exceeds LPM\ncurrent thresholds, and LPM mode is activated in hardware during this\nstate, it may trigger an overcurrent protection (OCP) fault in the\nregulator.\n\nTo prevent this, a 10ms delay is added after asserting HWRST. This\nallows the reset operation to complete while power rails remain active\nand in high-power mode.\n\nCurrently there is no way for Host to query whether the reset is\ncompleted or not and hence this the delay is based on experiments with\nQualcomm UFS controllers across multiple UFS vendors."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: ufs: ufs-qcom: Solucionar problema de OCP de UFS durante el apagado de UFS (PC=3)\n\nSeg\u00fan las especificaciones de UFS, la secuencia de apagado para un dispositivo UFS incluye:\n\n - Enviar un comando SSU con Power_Condition=3 y esperar una respuesta.\n\n - Poner RST_N en bajo.\n\n - Apagar REF_CLK.\n\n - Apagar VCC.\n\n - Apagar VCCQ/VCCQ2.\n\nComo parte del apagado de UFS, despu\u00e9s de la finalizaci\u00f3n del comando SSU, la activaci\u00f3n del reinicio de hardware (HWRST) activa el firmware del dispositivo para que se active y ejecute su rutina de reinicio. Esta rutina inicializa los bloques de hardware y tarda unos pocos milisegundos en completarse. Durante este tiempo, el ICCQ consume una gran corriente.\n\nEsta gran corriente de ICCQ puede causar problemas para el regulador que est\u00e1 suministrando energ\u00eda a UFS, porque la solicitud de apagado del controlador UFS al framework del regulador ser\u00e1 inmediatamente seguida por una solicitud de modo de baja potencia (LPM) por parte del framework del regulador. Esto lo hace el framework porque UFS, que es el \u00fanico cliente, est\u00e1 solicitando la desactivaci\u00f3n. Entonces, si el carril todav\u00eda est\u00e1 en proceso de apagado mientras el ICCQ excede los umbrales de corriente de LPM, y el modo LPM se activa en el hardware durante este estado, puede activar una falla de protecci\u00f3n contra sobrecorriente (OCP) en el regulador.\n\nPara evitar esto, se a\u00f1ade un retardo de 10ms despu\u00e9s de activar HWRST. Esto permite que la operaci\u00f3n de reinicio se complete mientras los carriles de alimentaci\u00f3n permanecen activos y en modo de alta potencia.\n\nActualmente no hay forma de que el Host consulte si el reinicio se ha completado o no y, por lo tanto, este retardo se basa en experimentos con controladores UFS de Qualcomm en m\u00faltiples proveedores de UFS."
    }
  ],
  "id": "CVE-2025-68236",
  "lastModified": "2026-10-30T13:18:19.840",
  "metrics": {},
  "published": "2025-12-16T14:15:58.640",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dd52d72f2bd727ca60c1bc9820a307b70e2154ec"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.