PT-2025-51649 · Linux+5 · Linux Kernel+5

Published 2025-10-23 · Updated 2026-05-26 · CVE-2025-68236

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s UFS (Universal Flash Storage) subsystem, specifically within the ufs-qcom component, related to power-down sequences. During UFS device power down, asserting a hardware reset (HWRST) can trigger the device firmware to wake up and initialize hardware blocks, potentially drawing a large current (ICCQ). This current surge may exceed the regulator’s limits, leading to an overcurrent protection (OCP) fault, particularly when the regulator framework initiates a low-power mode (LPM) request concurrently. The issue arises because the host has no way to determine when the reset operation is complete, necessitating a fixed delay after asserting HWRST to allow the reset to finish while power rails remain active.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

BDU:2026-01350

CVE-2025-68236

ECHO-83DD-9F16-5BB6

USN-8094-1

USN-8094-2

USN-8094-3

USN-8094-4

USN-8094-5

USN-8152-1

Affected Products

Debian

Linuxmint

Linux Kernel

Ufs

Ubuntu

Ufs-Qcom

References · 221

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68236.json · Exploit
• https://ubuntu.com/security/CVE-2025-68222 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68233 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68762 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8094-4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68219 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40345 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68724 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68332 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8094-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68728 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68234 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68356 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68213 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68305 · Vendor Advisory