{"id":"CVE-2025-38649","state":"PUBLISHED","title":"arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight","description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight\n\nAn infinite loop has been created by the Coresight devices. When only a\nsource device is enabled, the coresight_find_activated_sysfs_sink function\nis recursively invoked in an attempt to locate an active sink device,\nultimately leading to a stack overflow and system crash. Therefore, disable\nthe replicator1 to break the infinite loop and prevent a potential stack\noverflow.\n\nreplicator1_out   ->   funnel_swao_in6   ->   tmc_etf_swao_in   ->  tmc_etf_swao_out\n     |                                                                     |\nreplicator1_in                                                     replicator_swao_in\n     |                                                                     |\nreplicator0_out1                                                   replicator_swao_out0\n     |                                                                     |\nreplicator0_in                                                     funnel_in1_in3\n     |                                                                     |\ntmc_etf_out <- tmc_etf_in <- funnel_merg_out <- funnel_merg_in1 <- funnel_in1_out\n\n[call trace]\n   dump_backtrace+0x9c/0x128\n   show_stack+0x20/0x38\n   dump_stack_lvl+0x48/0x60\n   dump_stack+0x18/0x28\n   panic+0x340/0x3b0\n   nmi_panic+0x94/0xa0\n   panic_bad_stack+0x114/0x138\n   handle_bad_stack+0x34/0xb8\n   __bad_stack+0x78/0x80\n   coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight]\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   ...\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   coresight_enable_sysfs+0x80/0x2a0 [coresight]\n\nside effect after the change:\nOnly trace data originating from AOSS can reach the ETF_SWAO and EUD sinks.","publishedAt":"2025-08-22T16:00:53.731Z","updatedAt":"2026-05-11T21:32:18.211Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bf469630552a3950d0370dd5fd1f9bf0145d09d5","status":"affected","lessThan":"a9aaadcb0a6ce0c19616c46525112bc947c6f2b1","versionType":"git"},{"version":"bf469630552a3950d0370dd5fd1f9bf0145d09d5","status":"affected","lessThan":"fbe5be7893b8c7f58c999a26839cd30bc07654c6","versionType":"git"},{"version":"bf469630552a3950d0370dd5fd1f9bf0145d09d5","status":"affected","lessThan":"bd4f35786d5f0798cc1f8c187a81a7c998e6c58f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/boot/dts/qcom/qcs615.dtsi"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"6.15.10","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16.1","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/boot/dts/qcom/qcs615.dtsi"]}],"references":["https://git.kernel.org/stable/c/a9aaadcb0a6ce0c19616c46525112bc947c6f2b1","https://git.kernel.org/stable/c/fbe5be7893b8c7f58c999a26839cd30bc07654c6","https://git.kernel.org/stable/c/bd4f35786d5f0798cc1f8c187a81a7c998e6c58f"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38649.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38649","state":"PUBLISHED","datePublished":"2025-08-22T16:00:53.731Z","dateUpdated":"2026-05-11T21:32:18.211Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:24.030Z"},"containers":{"cna":{"title":"arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight\n\nAn infinite loop has been created by the Coresight devices. When only a\nsource device is enabled, the coresight_find_activated_sysfs_sink function\nis recursively invoked in an attempt to locate an active sink device,\nultimately leading to a stack overflow and system crash. Therefore, disable\nthe replicator1 to break the infinite loop and prevent a potential stack\noverflow.\n\nreplicator1_out   ->   funnel_swao_in6   ->   tmc_etf_swao_in   ->  tmc_etf_swao_out\n     |                                                                     |\nreplicator1_in                                                     replicator_swao_in\n     |                                                                     |\nreplicator0_out1                                                   replicator_swao_out0\n     |                                                                     |\nreplicator0_in                                                     funnel_in1_in3\n     |                                                                     |\ntmc_etf_out <- tmc_etf_in <- funnel_merg_out <- funnel_merg_in1 <- funnel_in1_out\n\n[call trace]\n   dump_backtrace+0x9c/0x128\n   show_stack+0x20/0x38\n   dump_stack_lvl+0x48/0x60\n   dump_stack+0x18/0x28\n   panic+0x340/0x3b0\n   nmi_panic+0x94/0xa0\n   panic_bad_stack+0x114/0x138\n   handle_bad_stack+0x34/0xb8\n   __bad_stack+0x78/0x80\n   coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight]\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   ...\n   coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight]\n   coresight_enable_sysfs+0x80/0x2a0 [coresight]\n\nside effect after the change:\nOnly trace data originating from AOSS can reach the ETF_SWAO and EUD sinks."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bf469630552a3950d0370dd5fd1f9bf0145d09d5","status":"affected","lessThan":"a9aaadcb0a6ce0c19616c46525112bc947c6f2b1","versionType":"git"},{"version":"bf469630552a3950d0370dd5fd1f9bf0145d09d5","status":"affected","lessThan":"fbe5be7893b8c7f58c999a26839cd30bc07654c6","versionType":"git"},{"version":"bf469630552a3950d0370dd5fd1f9bf0145d09d5","status":"affected","lessThan":"bd4f35786d5f0798cc1f8c187a81a7c998e6c58f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/boot/dts/qcom/qcs615.dtsi"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"6.15.10","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16.1","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/boot/dts/qcom/qcs615.dtsi"]}],"references":[{"url":"https://git.kernel.org/stable/c/a9aaadcb0a6ce0c19616c46525112bc947c6f2b1"},{"url":"https://git.kernel.org/stable/c/fbe5be7893b8c7f58c999a26839cd30bc07654c6"},{"url":"https://git.kernel.org/stable/c/bd4f35786d5f0798cc1f8c187a81a7c998e6c58f"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:32:18.211Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.15.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.16.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}