CVE-2025-38649: arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight
In the Linux kernel, the following vulnerability has been resolved:
arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight
An infinite loop has been created by the Coresight devices. When only a source device is enabled, the coresightfindactivatedsysfssink function is recursively invoked in an attempt to locate an active sink device, ultimately leading to a stack overflow and system crash. Therefore, disable the replicator1 to break the infinite loop and prevent a potential stack overflow.
replicator1out -> funnelswaoin6 -> tmcetfswaoin -> tmcetfswaoout | | replicator1in replicatorswaoin | | replicator0out1 replicatorswaoout0 | | replicator0in funnelin1in3 | | tmcetfout <- tmcetfin <- funnelmergout <- funnelmergin1 <- funnelin1out
[call trace] dumpbacktrace+0x9c/0x128 showstack+0x20/0x38 dumpstacklvl+0x48/0x60 dumpstack+0x18/0x28 panic+0x340/0x3b0 nmipanic+0x94/0xa0 panicbadstack+0x114/0x138 handlebadstack+0x34/0xb8 badstack+0x78/0x80 coresightfindactivatedsysfssink+0x28/0xa0 [coresight] coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] ... coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] coresightenablesysfs+0x80/0x2a0 [coresight]
side effect after the change: Only trace data originating from AOSS can reach the ETFSWAO and EUD sinks.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38649?
CVE-2025-38649 is classified as a vulnerability that can cause a denial of service due to an infinite loop in the Linux kernel's Coresight device.
How do I fix CVE-2025-38649?
To fix CVE-2025-38649, update the Linux kernel to the latest version where this vulnerability has been addressed.
What affected devices does CVE-2025-38649 target?
CVE-2025-38649 affects devices using the arm64 architecture in the Linux kernel that implement Coresight.
What are the implications of CVE-2025-38649?
The implications of CVE-2025-38649 include potential system crashes and unresponsiveness due to the infinite loop created by Coresight.
When was CVE-2025-38649 resolved?
CVE-2025-38649 was resolved in a kernel update that addressed the infinite loop issue with Coresight devices.