{"api_version":"1","generated_at":"2026-10-21T16:51:52+00:00","cve":"CVE-2025-68236","urls":{"html":"https://cve.report/CVE-2025-68236","api":"https://cve.report/api/cve/CVE-2025-68236.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-68236","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-68236"},"summary":{"title":"scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)\n\nAccording to UFS specifications, the power-off sequence for a UFS device\nincludes:\n\n - Sending an SSU command with Power_Condition=3 and await a response.\n\n - Asserting RST_N low.\n\n - Turning off REF_CLK.\n\n - Turning off VCC.\n\n - Turning off VCCQ/VCCQ2.\n\nAs part of ufs shutdown, after the SSU command completion, asserting\nhardware reset (HWRST) triggers the device firmware to wake up and\nexecute its reset routine. This routine initializes hardware blocks and\ntakes a few milliseconds to complete. During this time, the ICCQ draws a\nlarge current.\n\nThis large ICCQ current may cause issues for the regulator which is\nsupplying power to UFS, because the turn off request from UFS driver to\nthe regulator framework will be immediately followed by low power\nmode(LPM) request by regulator framework. This is done by framework\nbecause UFS which is the only client is requesting for disable. So if\nthe rail is still in the process of shutting down while ICCQ exceeds LPM\ncurrent thresholds, and LPM mode is activated in hardware during this\nstate, it may trigger an overcurrent protection (OCP) fault in the\nregulator.\n\nTo prevent this, a 10ms delay is added after asserting HWRST. This\nallows the reset operation to complete while power rails remain active\nand in high-power mode.\n\nCurrently there is no way for Host to query whether the reset is\ncompleted or not and hence this the delay is based on experiments with\nQualcomm UFS controllers across multiple UFS vendors.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-12-16 14:15:58","updated_at":"2026-10-21 13:18:21"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543","name":"https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833","name":"https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341","name":"https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141","name":"https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68236","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68236","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b61d0414136853fc38898829cde837ce5d691a9a 1c963811b0824d0f51aabd394986589a2126f341 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b61d0414136853fc38898829cde837ce5d691a9a 0c2619d1da8bd3d18524d69f12571a8cd7362833 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b61d0414136853fc38898829cde837ce5d691a9a b712f234a74c1f5ce70b5d7aec3fc2499c258141 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b61d0414136853fc38898829cde837ce5d691a9a 5127be409c6c3815c4a7d8f6d88043e44f9b9543 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 82783759e88beee69b710806e45acbb2fc589801 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.219 5.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.114 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17.10 6.17.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/ufs/host/ufs-qcom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1c963811b0824d0f51aabd394986589a2126f341","status":"affected","version":"b61d0414136853fc38898829cde837ce5d691a9a","versionType":"git"},{"lessThan":"0c2619d1da8bd3d18524d69f12571a8cd7362833","status":"affected","version":"b61d0414136853fc38898829cde837ce5d691a9a","versionType":"git"},{"lessThan":"b712f234a74c1f5ce70b5d7aec3fc2499c258141","status":"affected","version":"b61d0414136853fc38898829cde837ce5d691a9a","versionType":"git"},{"lessThan":"5127be409c6c3815c4a7d8f6d88043e44f9b9543","status":"affected","version":"b61d0414136853fc38898829cde837ce5d691a9a","versionType":"git"},{"status":"affected","version":"82783759e88beee69b710806e45acbb2fc589801","versionType":"git"},{"lessThan":"5.11","status":"affected","version":"5.10.219","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/ufs/host/ufs-qcom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.17.*","status":"unaffected","version":"6.17.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.18","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"5.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.114","versionStartIncluding":"5.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17.10","versionStartIncluding":"5.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18","versionStartIncluding":"5.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.219","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)\n\nAccording to UFS specifications, the power-off sequence for a UFS device\nincludes:\n\n - Sending an SSU command with Power_Condition=3 and await a response.\n\n - Asserting RST_N low.\n\n - Turning off REF_CLK.\n\n - Turning off VCC.\n\n - Turning off VCCQ/VCCQ2.\n\nAs part of ufs shutdown, after the SSU command completion, asserting\nhardware reset (HWRST) triggers the device firmware to wake up and\nexecute its reset routine. This routine initializes hardware blocks and\ntakes a few milliseconds to complete. During this time, the ICCQ draws a\nlarge current.\n\nThis large ICCQ current may cause issues for the regulator which is\nsupplying power to UFS, because the turn off request from UFS driver to\nthe regulator framework will be immediately followed by low power\nmode(LPM) request by regulator framework. This is done by framework\nbecause UFS which is the only client is requesting for disable. So if\nthe rail is still in the process of shutting down while ICCQ exceeds LPM\ncurrent thresholds, and LPM mode is activated in hardware during this\nstate, it may trigger an overcurrent protection (OCP) fault in the\nregulator.\n\nTo prevent this, a 10ms delay is added after asserting HWRST. This\nallows the reset operation to complete while power rails remain active\nand in high-power mode.\n\nCurrently there is no way for Host to query whether the reset is\ncompleted or not and hence this the delay is based on experiments with\nQualcomm UFS controllers across multiple UFS vendors."}],"providerMetadata":{"dateUpdated":"2026-10-21T12:38:06.913Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/1c963811b0824d0f51aabd394986589a2126f341"},{"url":"https://git.kernel.org/stable/c/0c2619d1da8bd3d18524d69f12571a8cd7362833"},{"url":"https://git.kernel.org/stable/c/b712f234a74c1f5ce70b5d7aec3fc2499c258141"},{"url":"https://git.kernel.org/stable/c/5127be409c6c3815c4a7d8f6d88043e44f9b9543"}],"title":"scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-68236","datePublished":"2025-12-16T14:08:30.224Z","dateReserved":"2025-12-16T13:41:40.258Z","dateUpdated":"2026-10-21T12:38:06.913Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-12-16 14:15:58","lastModifiedDate":"2026-10-21 13:18:21","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"68236","Ordinal":"1","Title":"scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC","CVE":"CVE-2025-68236","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"68236","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)\n\nAccording to UFS specifications, the power-off sequence for a UFS device\nincludes:\n\n - Sending an SSU command with Power_Condition=3 and await a response.\n\n - Asserting RST_N low.\n\n - Turning off REF_CLK.\n\n - Turning off VCC.\n\n - Turning off VCCQ/VCCQ2.\n\nAs part of ufs shutdown, after the SSU command completion, asserting\nhardware reset (HWRST) triggers the device firmware to wake up and\nexecute its reset routine. This routine initializes hardware blocks and\ntakes a few milliseconds to complete. During this time, the ICCQ draws a\nlarge current.\n\nThis large ICCQ current may cause issues for the regulator which is\nsupplying power to UFS, because the turn off request from UFS driver to\nthe regulator framework will be immediately followed by low power\nmode(LPM) request by regulator framework. This is done by framework\nbecause UFS which is the only client is requesting for disable. So if\nthe rail is still in the process of shutting down while ICCQ exceeds LPM\ncurrent thresholds, and LPM mode is activated in hardware during this\nstate, it may trigger an overcurrent protection (OCP) fault in the\nregulator.\n\nTo prevent this, a 10ms delay is added after asserting HWRST. This\nallows the reset operation to complete while power rails remain active\nand in high-power mode.\n\nCurrently there is no way for Host to query whether the reset is\ncompleted or not and hence this the delay is based on experiments with\nQualcomm UFS controllers across multiple UFS vendors.","Type":"Description","Title":"scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC"}]}}}