CVE-2025-38649 (GCVE-0-2025-38649)
Vulnerability from cvelistv5
Published
2025-08-22 16:00
Modified
2025-08-22 16:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight
An infinite loop has been created by the Coresight devices. When only a
source device is enabled, the coresight_find_activated_sysfs_sink function
is recursively invoked in an attempt to locate an active sink device,
ultimately leading to a stack overflow and system crash. Therefore, disable
the replicator1 to break the infinite loop and prevent a potential stack
overflow.
replicator1_out -> funnel_swao_in6 -> tmc_etf_swao_in -> tmc_etf_swao_out
| |
replicator1_in replicator_swao_in
| |
replicator0_out1 replicator_swao_out0
| |
replicator0_in funnel_in1_in3
| |
tmc_etf_out <- tmc_etf_in <- funnel_merg_out <- funnel_merg_in1 <- funnel_in1_out
[call trace]
dump_backtrace+0x9c/0x128
show_stack+0x20/0x38
dump_stack_lvl+0x48/0x60
dump_stack+0x18/0x28
panic+0x340/0x3b0
nmi_panic+0x94/0xa0
panic_bad_stack+0x114/0x138
handle_bad_stack+0x34/0xb8
__bad_stack+0x78/0x80
coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight]
coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]
coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]
coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]
coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]
...
coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]
coresight_enable_sysfs+0x80/0x2a0 [coresight]
side effect after the change:
Only trace data originating from AOSS can reach the ETF_SWAO and EUD sinks.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/boot/dts/qcom/qcs615.dtsi"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a9aaadcb0a6ce0c19616c46525112bc947c6f2b1",
"status": "affected",
"version": "bf469630552a3950d0370dd5fd1f9bf0145d09d5",
"versionType": "git"
},
{
"lessThan": "fbe5be7893b8c7f58c999a26839cd30bc07654c6",
"status": "affected",
"version": "bf469630552a3950d0370dd5fd1f9bf0145d09d5",
"versionType": "git"
},
{
"lessThan": "bd4f35786d5f0798cc1f8c187a81a7c998e6c58f",
"status": "affected",
"version": "bf469630552a3950d0370dd5fd1f9bf0145d09d5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/boot/dts/qcom/qcs615.dtsi"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.10",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.1",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17-rc1",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight\n\nAn infinite loop has been created by the Coresight devices. When only a\nsource device is enabled, the coresight_find_activated_sysfs_sink function\nis recursively invoked in an attempt to locate an active sink device,\nultimately leading to a stack overflow and system crash. Therefore, disable\nthe replicator1 to break the infinite loop and prevent a potential stack\noverflow.\n\nreplicator1_out -\u003e funnel_swao_in6 -\u003e tmc_etf_swao_in -\u003e tmc_etf_swao_out\n | |\nreplicator1_in replicator_swao_in\n | |\nreplicator0_out1 replicator_swao_out0\n | |\nreplicator0_in funnel_in1_in3\n | |\ntmc_etf_out \u003c- tmc_etf_in \u003c- funnel_merg_out \u003c- funnel_merg_in1 \u003c- funnel_in1_out\n\n[call trace]\n dump_backtrace+0x9c/0x128\n show_stack+0x20/0x38\n dump_stack_lvl+0x48/0x60\n dump_stack+0x18/0x28\n panic+0x340/0x3b0\n nmi_panic+0x94/0xa0\n panic_bad_stack+0x114/0x138\n handle_bad_stack+0x34/0xb8\n __bad_stack+0x78/0x80\n coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight]\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n ...\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n coresight_enable_sysfs+0x80/0x2a0 [coresight]\n\nside effect after the change:\nOnly trace data originating from AOSS can reach the ETF_SWAO and EUD sinks."
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T16:00:53.731Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9aaadcb0a6ce0c19616c46525112bc947c6f2b1"
},
{
"url": "https://git.kernel.org/stable/c/fbe5be7893b8c7f58c999a26839cd30bc07654c6"
},
{
"url": "https://git.kernel.org/stable/c/bd4f35786d5f0798cc1f8c187a81a7c998e6c58f"
}
],
"title": "arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38649",
"datePublished": "2025-08-22T16:00:53.731Z",
"dateReserved": "2025-04-16T04:51:24.030Z",
"dateUpdated": "2025-08-22T16:00:53.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-38649\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-22T16:15:39.617\",\"lastModified\":\"2025-08-22T18:08:51.663\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight\\n\\nAn infinite loop has been created by the Coresight devices. When only a\\nsource device is enabled, the coresight_find_activated_sysfs_sink function\\nis recursively invoked in an attempt to locate an active sink device,\\nultimately leading to a stack overflow and system crash. Therefore, disable\\nthe replicator1 to break the infinite loop and prevent a potential stack\\noverflow.\\n\\nreplicator1_out -\u003e funnel_swao_in6 -\u003e tmc_etf_swao_in -\u003e tmc_etf_swao_out\\n | |\\nreplicator1_in replicator_swao_in\\n | |\\nreplicator0_out1 replicator_swao_out0\\n | |\\nreplicator0_in funnel_in1_in3\\n | |\\ntmc_etf_out \u003c- tmc_etf_in \u003c- funnel_merg_out \u003c- funnel_merg_in1 \u003c- funnel_in1_out\\n\\n[call trace]\\n dump_backtrace+0x9c/0x128\\n show_stack+0x20/0x38\\n dump_stack_lvl+0x48/0x60\\n dump_stack+0x18/0x28\\n panic+0x340/0x3b0\\n nmi_panic+0x94/0xa0\\n panic_bad_stack+0x114/0x138\\n handle_bad_stack+0x34/0xb8\\n __bad_stack+0x78/0x80\\n coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight]\\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\\n ...\\n coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\\n coresight_enable_sysfs+0x80/0x2a0 [coresight]\\n\\nside effect after the change:\\nOnly trace data originating from AOSS can reach the ETF_SWAO and EUD sinks.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a9aaadcb0a6ce0c19616c46525112bc947c6f2b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd4f35786d5f0798cc1f8c187a81a7c998e6c58f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fbe5be7893b8c7f58c999a26839cd30bc07654c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…