In the Linux kernel, the following vulnerability has been resolved:
drm/msm/gpu: Fix crash when throttling GPU immediately during boot
There is a small chance that the GPU is already hot during boot. In that case, the call to ofdevfreqcooling_register() will immediately try to apply devfreq cooling, as seen in the following crash:
Unable to handle kernel paging request at virtual address 0000000000014110 pc : a6xxgpubusy+0x1c/0x58 [msm] lr : msmdevfreqgetdevstatus+0xbc/0x140 [msm] Call trace: a6xxgpubusy+0x1c/0x58 [msm] (P) devfreqsimpleondemandfunc+0x3c/0x150 devfrequpdatetarget+0x44/0xd8 qosmaxnotifiercall+0x30/0x84 blockingnotifiercallchain+0x6c/0xa0 pmqosupdatetarget+0xd0/0x110 freqqosapply+0x3c/0x74 applyconstraint+0x88/0x148 _devpmqosupdaterequest+0x7c/0xcc devpmqosupdaterequest+0x38/0x5c devfreqcoolingsetcurstate+0x98/0xf0 _thermalcdevupdate+0x64/0xb4 thermalcdevupdate+0x4c/0x58 stepwisemanage+0x1f0/0x318 _thermalzonedeviceupdate+0x278/0x424 _thermalcoolingdeviceregister+0x2bc/0x308 thermalofcoolingdeviceregister+0x10/0x1c ofdevfreqcoolingregisterpower+0x240/0x2bc ofdevfreqcoolingregister+0x14/0x20 msmdevfreqinit+0xc4/0x1a0 [msm] msmgpuinit+0x304/0x574 [msm] adrenogpuinit+0x1c4/0x2e0 [msm] a6xxgpuinit+0x5c8/0x9c8 [msm] adreno_bind+0x2a8/0x33c [msm] ...
At this point we haven't initialized the GMU at all yet, so we cannot read the GMU registers inside a6xxgpubusy(). A similar issue was fixed before in commit 6694482a70e9 ("drm/msm: Avoid unclocked GMU register access in 6xx gpubusy"): msmdevfreqinit() does call devfreqsuspenddevice(), but unlike msmdevfreqsuspend(), it doesn't set the df->suspended flag accordingly. This means the df->suspended flag does not match the actual devfreq state after initialization and msmdevfreqgetdev_status() will end up accessing GMU registers, causing the crash.
Fix this by setting df->suspended correctly during initialization.
Patchwork: https://patchwork.freedesktop.org/patch/650772/
[
{
"id": "CVE-2025-38354-112822a7",
"deprecated": false,
"digest": {
"length": 1441.0,
"function_hash": "69384105895989929312762754162101703716"
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c",
"function": "msm_devfreq_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1847ea44e3bdf7da8ff4158bc01b43a2e46394bd",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38354-373af6fc",
"deprecated": false,
"digest": {
"length": 1441.0,
"function_hash": "69384105895989929312762754162101703716"
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c",
"function": "msm_devfreq_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6f673cc9488fd722c601fe020601dba14db21b2",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38354-539cd02f",
"deprecated": false,
"digest": {
"line_hashes": [
"237924900405933662415297671910313780320",
"332598252371997666262182886576674596559",
"175164813428956352435441011565371830371",
"134030058650236251713636444478083306662"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6f673cc9488fd722c601fe020601dba14db21b2",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38354-9f78257a",
"deprecated": false,
"digest": {
"length": 1441.0,
"function_hash": "69384105895989929312762754162101703716"
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c",
"function": "msm_devfreq_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b71717735be48d7743a34897e9e44a0b53e30c0e",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38354-ba324458",
"deprecated": false,
"digest": {
"length": 1441.0,
"function_hash": "69384105895989929312762754162101703716"
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c",
"function": "msm_devfreq_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7946a10f8da75abc494e4bb80243e153e93e459a",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38354-da2206ab",
"deprecated": false,
"digest": {
"line_hashes": [
"237924900405933662415297671910313780320",
"332598252371997666262182886576674596559",
"175164813428956352435441011565371830371",
"134030058650236251713636444478083306662"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1847ea44e3bdf7da8ff4158bc01b43a2e46394bd",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38354-dd04db24",
"deprecated": false,
"digest": {
"line_hashes": [
"237924900405933662415297671910313780320",
"332598252371997666262182886576674596559",
"175164813428956352435441011565371830371",
"134030058650236251713636444478083306662"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7946a10f8da75abc494e4bb80243e153e93e459a",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38354-dd8a4f95",
"deprecated": false,
"digest": {
"line_hashes": [
"333508134459547474609590706664598121315",
"328323717297225813754938321818146512404",
"240836267697646235025949305056465839972",
"134030058650236251713636444478083306662"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae2015b0dbc0eea7aaf022194371f451f784d994",
"signature_version": "v1",
"signature_type": "Line"
},
{
"id": "CVE-2025-38354-f91c614b",
"deprecated": false,
"digest": {
"length": 1342.0,
"function_hash": "309809230014250783237002509529694545351"
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c",
"function": "msm_devfreq_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae2015b0dbc0eea7aaf022194371f451f784d994",
"signature_version": "v1",
"signature_type": "Function"
},
{
"id": "CVE-2025-38354-ffa6c4f9",
"deprecated": false,
"digest": {
"line_hashes": [
"237924900405933662415297671910313780320",
"332598252371997666262182886576674596559",
"175164813428956352435441011565371830371",
"134030058650236251713636444478083306662"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/msm/msm_gpu_devfreq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b71717735be48d7743a34897e9e44a0b53e30c0e",
"signature_version": "v1",
"signature_type": "Line"
}
]