CVE-2025-22011

ARM: dts: bcm2711: Fix xHCI power-domain

Medium · published April 8, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ARM: dts: bcm2711: Fix xHCI power-domain

During s2idle tests on the Raspberry CM4 the VPU firmware always crashes

on xHCI power-domain resume:

root@raspberrypi:/sys/power# echo freeze > state

[ 70.724347] xhci_suspend finished

[ 70.727730] xhci_plat_suspend finished

[ 70.755624] bcm2835-power bcm2835-power: Power grafx off

[ 70.761127] USB: Set power to 0

[ 74.653040] USB: Failed to set power to 1 (-110)

This seems to be caused because of the mixed usage of

raspberrypi-power and bcm2835-power at the same time. So avoid

the usage of the VPU firmware power-domain driver, which

prevents the VPU crash.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00194 · 8.6th percentile
Published
2025-04-08T08:18Z
EPSS history
Timeline
  • 08 APR 08:18Z
    ARM: dts: bcm2711: Fix xHCI power-domain
    cvelistv5