CVE-2025-68236

{
  "id": "CVE-2025-68236",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-16T14:15:58.640",
  "lastModified": "2026-10-30T13:18:19.840",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)\n\nAccording to UFS specifications, the power-off sequence for a UFS device\nincludes:\n\n - Sending an SSU command with Power_Condition=3 and await a response.\n\n - Asserting RST_N low.\n\n - Turning off REF_CLK.\n\n - Turning off VCC.\n\n - Turning off VCCQ/VCCQ2.\n\nAs part of ufs shutdown, after the SSU command completion, asserting\nhardware reset (HWRST) triggers the device firmware to wake up and\nexecute its reset routine. This routine initializes hardware blocks and\ntakes a few milliseconds to complete. During this time, the ICCQ draws a\nlarge current.\n\nThis large ICCQ current may cause issues for the regulator which is\nsupplying power to UFS, because the turn off request from UFS driver to\nthe regulator framework will be immediately followed by low power\nmode(LPM) request by regulator framework. This is done by framework\nbecause UFS which is the only client is requesting for disable. So if\nthe rail is still in the process of shutting down while ICCQ exceeds LPM\ncurrent thresholds, and LPM mode is activated in hardware during this\nstate, it may trigger an overcurrent protection (OCP) fault in the\nregulator.\n\nTo prevent this, a 10ms delay is added after asserting HWRST. This\nallows the reset operation to complete while power rails remain active\nand in high-power mode.\n\nCurrently there is no way for Host to query whether the reset is\ncompleted or not and hence this the delay is based on experiments with\nQualcomm UFS controllers across multiple UFS vendors."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: ufs: ufs-qcom: Solucionar problema de OCP de UFS durante el apagado de UFS (PC=3)\n\nSegún las especificaciones de UFS, la secuencia de apagado para un dispositivo UFS incluye:\n\n - Enviar un comando SSU con Power_Condition=3 y esperar una respuesta.\n\n - Poner RST_N en bajo.\n\n - Apagar REF_CLK.\n\n - Apagar VCC.\n\n - Apagar VCCQ/VCCQ2.\n\nComo parte del apagado de UFS, después de la finalización del comando SSU, la activación del reinicio de hardware (HWRST) activa el firmware del dispositivo para que se active y ejecute su rutina de reinicio. Esta rutina inicializa los bloques de hardware y tarda unos pocos milisegundos en completarse. Durante este tiempo, el ICCQ consume una gran corriente.\n\nEsta gran corriente de ICCQ puede causar problemas para el regulador que está suministrando energía a UFS, porque la solicitud de apagado del controlador UFS al framework del regulador será inmediatamente seguida por una solicitud de modo de baja potencia (LPM) por parte del framework del regulador. Esto lo hace el framework porque UFS, que es el único cliente, está solicitando la desactivación. Entonces, si el carril todavía está en proceso de apagado mientras el ICCQ excede los umbrales de corriente de LPM, y el modo LPM se activa en el hardware durante este estado, puede activar una falla de protección contra sobrecorriente (OCP) en el regulador.\n\nPara evitar esto, se añade un retardo de 10ms después de activar HWRST. Esto permite que la operación de reinicio se complete mientras los carriles de alimentación permanecen activos y en modo de alta potencia.\n\nActualmente no hay forma de que el Host consulte si el reinicio se ha completado o no y, por lo tanto, este retardo se basa en experimentos con controladores UFS de Qualcomm en múltiples proveedores de UFS."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/ufs/host/ufs-qcom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "lessThan": "dd52d72f2bd727ca60c1bc9820a307b70e2154ec",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "lessThan": "1c963811b0824d0f51aabd394986589a2126f341",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "lessThan": "0c2619d1da8bd3d18524d69f12571a8cd7362833",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "lessThan": "b712f234a74c1f5ce70b5d7aec3fc2499c258141",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b61d0414136853fc38898829cde837ce5d691a9a",
              "lessThan": "5127be409c6c3815c4a7d8f6d88043e44f9b9543",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "82783759e88beee69b710806e45acbb2fc589801",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5.10.219",
              "lessThan": "5.11",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/ufs/host/ufs-qcom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.12",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.12",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.160",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.114",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.10",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dd52d72f2bd727ca60c1bc9820a307b70e2154ec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}