CVE-2025-22011

ARM: dts: bcm2711: Fix xHCI power-domain

State: Published
Severity: 5.5 Medium
Published: Apr 8, 2025
Updated: May 11, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ARM: dts: bcm2711: Fix xHCI power-domain

During s2idle tests on the Raspberry CM4 the VPU firmware always crashes on xHCI power-domain resume:

root@raspberrypi:/sys/power# echo freeze > state [ 70.724347] xhci_suspend finished [ 70.727730] xhci_plat_suspend finished [ 70.755624] bcm2835-power bcm2835-power: Power grafx off [ 70.761127] USB: Set power to 0

[ 74.653040] USB: Failed to set power to 1 (-110)

This seems to be caused because of the mixed usage of raspberrypi-power and bcm2835-power at the same time. So avoid the usage of the VPU firmware power-domain driver, which prevents the VPU crash.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	522c35e08b53f157ad3e51848caa861b258001e4 to before b8a47aa0b3df701d0fc41b3caf78d00571776be0Affected 522c35e08b53f157ad3e51848caa861b258001e4 to before 393947e06867923d4c2be380d46efd03407a8ce2Affected 522c35e08b53f157ad3e51848caa861b258001e4 to before f44fa354a0715577ca32b085f6f60bcf32c748ddAffected
LinuxLinux	6.8Affected before 6.8Not affected 6.12.21 through 6.12.Not affected 6.13.9 through 6.13.Not affected 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.