UFS Power Management Flaw in Linux Kernel Affecting Qualcomm Devices

CVE-2025-68236

What is CVE-2025-68236?

A vulnerability has been identified in the Linux kernel's implementation of UFS (Universal Flash Storage) power management, specifically within the Qualcomm UFS controller. During the power shutdown sequence for UFS devices, the device firmware may trigger an excessive current draw that interacts improperly with the regulators. This can lead to overcurrent protection (OCP) faults if the power management sequence is not properly timed. To mitigate this issue, a delay of 10 milliseconds is introduced after the hardware reset assertion, ensuring that the power rails remain active until the reset routine completes. This fix aims to enhance the stability and reliability of UFS devices during shutdown procedures.

References