UBUNTU-CVE-2025-38649: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight An infinite loop has been created by the Coresight devices. When only a source device is enabled, the coresightfindactivatedsysfssink function is recursively invoked in an attempt to locate an active sink device, ultimately leading to a stack overflow and system crash. Therefore, disable the replicator1 to break the infinite loop and prevent a potential stack overflow. replicator1out -> funnelswaoin6 -> tmcetfswaoin -> tmcetfswaoout | | replicator1in replicatorswaoin | | replicator0out1 replicatorswaoout0 | | replicator0in funnelin1in3 | | tmcetfout <- tmcetfin <- funnelmergout <- funnelmergin1 <- funnelin1out [call trace] dumpbacktrace+0x9c/0x128 showstack+0x20/0x38 dumpstacklvl+0x48/0x60 dumpstack+0x18/0x28 panic+0x340/0x3b0 nmipanic+0x94/0xa0 panicbadstack+0x114/0x138 handlebadstack+0x34/0xb8 badstack+0x78/0x80 coresightfindactivatedsysfssink+0x28/0xa0 [coresight] coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] ... coresightfindactivatedsysfssink+0x5c/0xa0 [coresight] coresightenablesysfs+0x80/0x2a0 [coresight] side effect after the change: Only trace data originating from AOSS can reach the ETFSWAO and EUD sinks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1020.21~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-36.36.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16~24.04.1 - Configuration
Disable the replicator1 Coresight device in the device tree to break the infinite loop and prevent a potential stack overflow.
Qualcomm QCS615 Coresight replicator1 = disabled