LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71200: mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode When operating in HS200 or HS400 timing modes, reducing the clock frequency below 52MHz will lead to link broken as the Rockchip DWC MSHC controller requires maintaining a minimum clock of 52MHz in these modes. Add a check to prevent illegal clock reduction through debugfs: root@debian:/# echo 50000000 > /sys/kernel/debug/mmc0/clock root@debian:/# [ 30.090146] mmc0: running CQE recovery mmc0: cqhci: Failed to halt mmc0: cqhci: spurious TCN for tag 0 WARNING: drivers/mmc/host/cqhci-core.c:797 at cqhci_irq+0x254/0x818, CPU#1: kworker/1:0H/24 Modules linked in: CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Not tainted 6.19.0-rc1-00001-g09db0998649d-dirty #204 PREEMPT Hardware name: Rockchip RK3588 EVB1 V10 Board (DT) Workqueue: kblockd blk_mq_run_work_fn pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : cqhci_irq+0x254/0x818 lr : cqhci_irq+0x254/0x818 ...

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can break eMMC/SD storage communication on Rockchip systems using the DWC MSHC controller when a debug setting lowers the clock too far in HS200 or HS400 mode. The known impact is availability and reliability, not data theft. Exposure appears narrow and tied to local debugfs control.

Executive priority

Prioritize patching for Rockchip-based appliances, embedded systems, or edge devices where storage disruption affects service availability. This should not outrank remotely exploitable or actively exploited kernel issues, but it is worth scheduling into normal kernel maintenance.

Technical view

The sdhci-of-dwcmshc driver allowed clock reduction below 52MHz while in HS200/HS400 timing modes. Rockchip DWC MSHC requires at least 52MHz there, so debugfs clock changes could break the link and trigger CQE recovery, halt failures, and kernel warnings. Stable kernel fixes add a guard against illegal reductions.

Likely exposure

Most exposed assets are Linux systems on Rockchip DWC MSHC hardware using HS200 or HS400 storage timing, especially boards where debugfs is mounted and writable by privileged users or automation. Generic Linux servers without this controller path are unlikely to be affected based on the bundle.

Exploitation context

The source bundle does not show active exploitation, KEV listing, remote reachability, or unprivileged access. The example uses root-controlled debugfs to trigger the condition. Treat this as a constrained local availability risk unless vendor advisories add broader impact.

Researcher notes

Evidence is limited to the CVE text and stable kernel references. The vulnerability centers on preventing an invalid debugfs-driven clock state, with no CVSS, CWE, or exploit activity provided. Validate affectedness through hardware, kernel version, driver use, and debugfs exposure.

Mitigation direction

  • Update to a kernel containing the referenced stable fixes.
  • Track your Linux distribution or device vendor advisory for packaged kernels.
  • Limit debugfs availability on production systems where operationally feasible.
  • Avoid manual MMC clock changes on affected Rockchip systems until patched.

Validation and detection

  • Inventory Rockchip-based Linux devices using DWC MSHC MMC storage.
  • Check whether affected kernels or listed commits are present.
  • Confirm debugfs is not broadly exposed on production systems.
  • Review logs for MMC CQE recovery, halt failures, or related warnings.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71200 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc6f361cba51c536e7a6af31973c6a4e5d7e4e2e4, c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4, c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4, c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4, c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4unaffected
LinuxLinux6.0, 0, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.