PT-2026-38924 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2025-71299

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the spi: cadence-quadspi driver where a runtime PM (Power Management) disable operation in the probe() function error paths can trigger duplicate clock disables. This occurs because the probe() function manually disables clocks while runtime PM may also release the same reference to the main clock for the IP, leading to warnings from the clock subsystem. This behavior is more likely to occur when there is missing or broken Device Tree (DT) description for the flashes attached to the controller.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-71299

Affected Products

Linux Kernel

References · 12

• https://git.kernel.org/stable/c/dcaa104ad9c860a6dbd5797919e0ec0b1cd5a57a · Patch
• https://ubuntu.com/security/CVE-2025-71299 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-71299 · Vendor Advisory
• https://git.kernel.org/stable/c/08dca4c8099a41a9fa3be128a793387603f73a17 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-71299 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-71299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71299 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-71299 · Security Note
• https://git.kernel.org/stable/c/9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3 · Patch
• https://twitter.com/CVEnew/status/2053174665091187146 · Twitter Post
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://git.kernel.org/linus/9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3 · Note