LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71299: spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing

In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing The recent refactoring of where runtime PM is enabled done in commit f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance") made the fact that when we do a pm_runtime_disable() in the error paths of probe() we can trigger a runtime disable which in turn results in duplicate clock disables. This is particularly likely to happen when there is missing or broken DT description for the flashes attached to the controller. Early on in the probe function we do a pm_runtime_get_noresume() since the probe function leaves the device in a powered up state but in the error path we can't assume that PM is enabled so we also manually disable everything, including clocks. This means that when runtime PM is active both it and the probe function release the same reference to the main clock for the IP, triggering warnings from the clock subsystem: [ 8.693719] clk:75:7 already disabled [ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb ... [ 8.694261] clk_core_disable+0xa0/0xb4 (P) [ 8.694272] clk_disable+0x38/0x60 [ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi] [ 8.694309] platform_probe+0x5c/0xa4 Dealing with this issue properly is complicated by the fact that we don't know if runtime PM is active so can't tell if it will disable the clocks or not. We can, however, sidestep the issue for the flash descriptions by moving their parsing to when we parse the controller properties which also save us doing a bunch of setup which can never be used so let's do that.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver flaw affecting Cadence QuadSPI controller probing. A bad or missing device-tree flash description can cause duplicate clock disables during startup error handling, producing kernel warnings and potentially unstable device initialization.

Executive priority

Treat this as a targeted embedded Linux reliability issue until severity data improves. Prioritize affected product lines using Cadence QuadSPI hardware, especially devices with recent kernel updates or custom device trees.

Technical view

In spi-cadence-quadspi, runtime PM enablement changed probe error-path assumptions. When flash DT parsing fails after PM is active, both runtime PM and manual cleanup can release the same clock reference. The fix moves flash DT parsing earlier with controller property parsing.

Likely exposure

Exposure appears limited to Linux systems using the Cadence QuadSPI SPI controller driver, especially embedded devices with missing or broken flash device-tree descriptions. The source data lists affected Linux versions but provides no CVSS score.

Exploitation context

CISA KEV is false, and the provided sources do not report active exploitation. The described trigger is a driver probe failure path tied to hardware description data, not a remote attack path.

Researcher notes

Evidence is incomplete: no CVSS, CWE, exploit report, or detailed impact beyond warnings and duplicate clock disable behavior. The practical risk depends on platform-specific probe behavior and whether failed initialization affects boot or flash access.

Mitigation direction

  • Check distribution or device-vendor kernels for the referenced stable fixes.
  • Update affected firmware or kernels when a vendor-provided fixed build is available.
  • Validate Cadence QuadSPI flash device-tree descriptions on affected embedded platforms.
  • Follow upstream Linux stable guidance; do not assume a workaround replaces the kernel fix.

Validation and detection

  • Inventory systems using the spi-cadence-quadspi driver or Cadence QuadSPI hardware.
  • Compare deployed kernel packages against vendor advisories and referenced stable commits.
  • Review boot logs for duplicate clock-disable warnings involving cqspi_probe.
  • Check device-tree flash nodes for missing or malformed Cadence QuadSPI descriptions.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71299 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf1eb4e792bb1ee3dcdffa66f8a83a4867cda2dd3, f1eb4e792bb1ee3dcdffa66f8a83a4867cda2dd3, f1eb4e792bb1ee3dcdffa66f8a83a4867cda2dd3, 7f3c5e0585250097be39736e6b182c5779b7b609, 6.17.11unaffected
LinuxLinux6.18, 0, 6.18.16, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.