CVE-2025-22011: ARM: dts: bcm2711: Fix xHCI power-domain
In the Linux kernel, the following vulnerability has been resolved:
ARM: dts: bcm2711: Fix xHCI power-domain
During s2idle tests on the Raspberry CM4 the VPU firmware always crashes on xHCI power-domain resume:
root@raspberrypi:/sys/power# echo freeze > state [ 70.724347] xhcisuspend finished [ 70.727730] xhciplatsuspend finished [ 70.755624] bcm2835-power bcm2835-power: Power grafx off [ 70.761127] USB: Set power to 0
[ 74.653040] USB: Failed to set power to 1 (-110)
This seems to be caused because of the mixed usage of raspberrypi-power and bcm2835-power at the same time. So avoid the usage of the VPU firmware power-domain driver, which prevents the VPU crash.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22011?
CVE-2025-22011 is classified as a medium severity vulnerability.
How do I fix CVE-2025-22011?
To address CVE-2025-22011, update the Linux kernel on your affected system to the latest version.
Which systems are affected by CVE-2025-22011?
CVE-2025-22011 affects the Linux kernel and specifically the Raspberry Pi Compute Module 4.
What type of vulnerability is CVE-2025-22011?
CVE-2025-22011 is a power domain management issue within the ARM architecture of the Linux kernel.
When was CVE-2025-22011 discovered?
CVE-2025-22011 was addressed in patches released in 2025.