LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereference in runtime PM callbacks that expect valid driver data. There is a small window where the suspend callback may run after PM runtime enabling and before runtime forbid. This causes a sporadic crash during boot: ``` Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1 [...] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT Workqueue: pm pm_runtime_work pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2] lr : pm_generic_runtime_suspend+0x2c/0x44 [...] ``` Attach the QPHY instance as driver data before enabling runtime PM to prevent NULL pointer dereference in runtime PM callbacks. Reorder pm_runtime_enable() and pm_runtime_forbid() to prevent a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE is a Linux kernel boot-stability flaw in the Qualcomm QUSB2 PHY driver. A timing window during runtime power management can trigger a NULL pointer dereference and crash the system during boot. The source describes sporadic crashes, not data theft or privilege escalation.

Executive priority

Treat as an operational availability issue, not an internet-facing emergency based on current evidence. Prioritize patching affected Qualcomm QUSB2 PHY Linux platforms where reboot reliability, embedded uptime, or field recovery costs matter.

Technical view

The driver enables runtime PM before storing the QPHY instance as driver data. Runtime suspend callbacks can run in that window and dereference missing driver data in qusb2_phy_runtime_suspend. The fix attaches driver data first, reorders runtime PM handling, and uses devres-managed cleanup.

Likely exposure

Exposure appears limited to Linux kernels using the phy_qcom_qusb2 driver on affected kernel lines or custom kernels carrying the vulnerable ordering. The source lists Linux as affected but provides no CPEs or product-specific platform inventory.

Exploitation context

CISA KEV is false, and the provided sources do not report active exploitation. The described impact is a sporadic boot-time kernel crash caused by runtime PM timing, with no public evidence here of remote or user-triggered exploitation.

Researcher notes

Evidence is limited to the CVE record and kernel stable references. No CVSS, CWE, exploit report, or product CPE mapping is provided. Analysis should focus on affected kernel branches, driver presence, and whether downstream kernels include the ordering fix.

Mitigation direction

  • Apply vendor or distribution kernel updates containing the referenced stable fixes.
  • For custom kernels, evaluate backporting the upstream qcom-qusb2 driver fix.
  • Check vendor advisories before assuming affected package versions are fixed.
  • Prioritize systems where boot reliability for Qualcomm QUSB2 PHY platforms is operationally critical.

Validation and detection

  • Inventory Linux kernel versions and whether phy_qcom_qusb2 is built or loaded.
  • Review boot logs for NULL dereference in qusb2_phy_runtime_suspend or pm_runtime_work.
  • Compare kernel source or packages against the referenced stable commits.
  • After updating, confirm repeated boots complete without the runtime PM crash.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71193 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux891a96f65ac3b12883ddbc6d1a9adf6e54dc903c, 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c, 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c, 891a96f65ac3b12883ddbc6d1a9adf6e54dc903cunaffected
LinuxLinux4.17, 0, 6.6.122, 6.12.67, 6.18.7, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.