Security readout for executives and security teams
Plain-English summary
This CVE is a Linux kernel crash issue on Qualcomm QCS615 arm64 device-tree Coresight wiring. A loop in trace-device relationships can cause recursive sink lookup until stack overflow and system crash. The source describes a fix that disables one replicator path to break the loop.
Executive priority
Prioritize affected embedded, mobile, edge, or appliance platforms using QCS615 where kernel crashes affect availability. This is not documented as remotely exploitable or actively exploited in the provided sources, so urgency should be driven by fleet presence and operational reliance on the affected hardware.
Technical view
When only a Coresight source device is enabled, coresight_find_activated_sysfs_sink can recursively follow the QCS615 Coresight topology until stack exhaustion. The kernel fix disables replicator1, preventing the infinite loop. The source notes a functional side effect: only AOSS-origin trace data can reach ETF_SWAO and EUD sinks.
Likely exposure
Exposure appears limited to Linux kernels with the affected QCS615 arm64 device-tree Coresight topology. The bundle lists affected kernel versions including 6.14, 6.15.10, 6.16.1, and 6.17, but does not map this to distributions, appliances, or cloud images.
Exploitation context
No source in the bundle reports active exploitation, and KEV is false. The described trigger is operational: enabling only a Coresight source device causes recursive lookup and a crash. Practical exposure likely depends on local access and Coresight sysfs/debug interface availability.
Researcher notes
The record lacks CVSS, CWE, distribution mapping, and exploitability detail. Treat this as a source-grounded kernel denial-of-service issue tied to a specific Coresight topology. Validate against exact kernel trees because vendors may backport the stable commits without changing the visible version string.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable fixes.
- Check vendor or distribution advisories for backported QCS615 Coresight fixes.
- For custom kernels, confirm replicator1 is disabled as described upstream.
- Limit untrusted access to Coresight debug and sysfs interfaces.
- Assess the tracing side effect before deploying to diagnostic environments.
Validation and detection
- Inventory systems using Qualcomm QCS615 and Linux arm64 kernels.
- Compare running kernel versions against vendor-fixed builds or upstream stable commits.
- For source builds, inspect the QCS615 device tree for the replicator1 change.
- Review crash logs for repeated coresight_find_activated_sysfs_sink stack traces.
- Confirm required Coresight tracing workflows still function after patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38649 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a9aaadcb0a6ce0c19616c46525112bc947c6f2b1CVE reference, Linux
- https://git.kernel.org/stable/c/fbe5be7893b8c7f58c999a26839cd30bc07654c6CVE reference, Linux
- https://git.kernel.org/stable/c/bd4f35786d5f0798cc1f8c187a81a7c998e6c58fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.