CVE-2025-71299: spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing
In the Linux kernel, the following vulnerability has been resolved:
spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing
The recent refactoring of where runtime PM is enabled done in commit
f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to
avoid imbalance") made the fact that when we do a pm_runtime_disable()
in the error paths of probe() we can trigger a runtime disable which in
turn results in duplicate clock disables. This is particularly likely
to happen when there is missing or broken DT description for the flashes
attached to the controller.
Early on in the probe function we do a pm_runtime_get_noresume() since
the probe function leaves the device in a powered up state but in the
error path we can't assume that PM is enabled so we also manually
disable everything, including clocks. This means that when runtime PM is
active both it and the probe function release the same reference to the
main clock for the IP, triggering warnings from the clock subsystem:
[ 8.693719] clk:75:7 already disabled
[ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb
...
[ 8.694261] clk_core_disable+0xa0/0xb4 (P)
[ 8.694272] clk_disable+0x38/0x60
[ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi]
[ 8.694309] platform_probe+0x5c/0xa4
Dealing with this issue properly is complicated by the fact that we
don't know if runtime PM is active so can't tell if it will disable the
clocks or not. We can, however, sidestep the issue for the flash
descriptions by moving their parsing to when we parse the controller
properties which also save us doing a bunch of setup which can never be
used so let's do that.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver flaw affecting Cadence QuadSPI controller probing. A bad or missing device-tree flash description can cause duplicate clock disables during startup error handling, producing kernel warnings and potentially unstable device initialization.
Executive priority
Treat this as a targeted embedded Linux reliability issue until severity data improves. Prioritize affected product lines using Cadence QuadSPI hardware, especially devices with recent kernel updates or custom device trees.
Technical view
In spi-cadence-quadspi, runtime PM enablement changed probe error-path assumptions. When flash DT parsing fails after PM is active, both runtime PM and manual cleanup can release the same clock reference. The fix moves flash DT parsing earlier with controller property parsing.
Likely exposure
Exposure appears limited to Linux systems using the Cadence QuadSPI SPI controller driver, especially embedded devices with missing or broken flash device-tree descriptions. The source data lists affected Linux versions but provides no CVSS score.
Exploitation context
CISA KEV is false, and the provided sources do not report active exploitation. The described trigger is a driver probe failure path tied to hardware description data, not a remote attack path.
Researcher notes
Evidence is incomplete: no CVSS, CWE, exploit report, or detailed impact beyond warnings and duplicate clock disable behavior. The practical risk depends on platform-specific probe behavior and whether failed initialization affects boot or flash access.
Mitigation direction
Check distribution or device-vendor kernels for the referenced stable fixes.
Update affected firmware or kernels when a vendor-provided fixed build is available.
Validate Cadence QuadSPI flash device-tree descriptions on affected embedded platforms.
Follow upstream Linux stable guidance; do not assume a workaround replaces the kernel fix.
Validation and detection
Inventory systems using the spi-cadence-quadspi driver or Cadence QuadSPI hardware.
Compare deployed kernel packages against vendor advisories and referenced stable commits.
Review boot logs for duplicate clock-disable warnings involving cqspi_probe.
Check device-tree flash nodes for missing or malformed Cadence QuadSPI descriptions.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-71299 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
4Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
May 8, 2026, 13:11 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.