In the Linux kernel, the following vulnerability has been resolved:
usb: renesas_usbhs: Reorder clock handling and power management in probe
Reorder the initialization sequence in usbhs_probe() to enable runtime
PM before accessing registers, preventing potential crashes due to
uninitialized clocks.
Currently, in the probe path, registers are accessed before enabling the clocks, leading to a synchronous external abort on the RZ/V2H SoC. The problematic call flow is as follows:
usbhs_probe()
usbhs_sys_clock_ctrl()
usbhs_bset()
usbhs_write()
iowrite16() <-- Register access before enabling clocks
Since iowrite16() is performed without ensuring the required clocks are
enabled, this can lead to access errors. To fix this, enable PM runtime
early in the probe function and ensure clocks are acquired before register
access, preventing crashes like the following on RZ/V2H:
[13.272640] Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP [13.280814] Modules linked in: cec renesasusbhs(+) drmkmshelper fuse drm backlight ipv6 [13.289088] CPU: 1 UID: 0 PID: 195 Comm: (udev-worker) Not tainted 6.14.0-rc7+ #98 [13.296640] Hardware name: Renesas RZ/V2H EVK Board based on r9a09g057h44 (DT) [13.303834] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [13.310770] pc : usbhsbset+0x14/0x4c [renesasusbhs] [13.315831] lr : usbhsprobe+0x2e4/0x5ac [renesasusbhs] [13.321138] sp : ffff8000827e3850 [13.324438] x29: ffff8000827e3860 x28: 0000000000000000 x27: ffff8000827e3ca0 [13.331554] x26: ffff8000827e3ba0 x25: ffff800081729668 x24: 0000000000000025 [13.338670] x23: ffff0000c0f08000 x22: 0000000000000000 x21: ffff0000c0f08010 [13.345783] x20: 0000000000000000 x19: ffff0000c3b52080 x18: 00000000ffffffff [13.352895] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000827e36ce [13.360009] x14: 00000000000003d7 x13: 00000000000003d7 x12: 0000000000000000 [13.367122] x11: 0000000000000000 x10: 0000000000000aa0 x9 : ffff8000827e3750 [13.374235] x8 : ffff0000c1850b00 x7 : 0000000003826060 x6 : 000000000000001c [13.381347] x5 : 000000030d5fcc00 x4 : ffff8000825c0000 x3 : 0000000000000000 [13.388459] x2 : 0000000000000400 x1 : 0000000000000000 x0 : ffff0000c3b52080 [13.395574] Call trace: [13.398013] usbhsbset+0x14/0x4c [renesasusbhs] (P) [13.403076] platformprobe+0x68/0xdc [13.406738] reallyprobe+0xbc/0x2c0 [13.410306] _driverprobedevice+0x78/0x120 [13.414653] driverprobedevice+0x3c/0x154 [13.418825] _driverattach+0x90/0x1a0 [13.422647] busforeachdev+0x7c/0xe0 [13.426470] driverattach+0x24/0x30 [13.430032] busadddriver+0xe4/0x208 [13.433766] driverregister+0x68/0x130 [13.437587] _platformdriverregister+0x24/0x30 [13.442273] renesasusbhsdriverinit+0x20/0x1000 [renesasusbhs] [13.448450] dooneinitcall+0x60/0x1d4 [13.452276] doinitmodule+0x54/0x1f8 [13.456014] loadmodule+0x1754/0x1c98 [13.459750] initmodulefromfile+0x88/0xcc [13.464004] _arm64sysfinitmodule+0x1c4/0x328 [13.468689] invokesyscall+0x48/0x104 [13.472426] el0svccommon.constprop.0+0xc0/0xe0 [13.477113] doel0svc+0x1c/0x28 [13.480415] el0svc+0x30/0xcc [13.483460] el0t64synchandler+0x10c/0x138 [13.487800] el0t64_sync+0x198/0x19c [13.491453] Code: 2a0103e1 12003c42 12003c63 8b010084 (79400084) [13.497522] ---[ end trace 0000000000000000 ]---
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffb34a60ce86656ba12d46e91f1ccc71dd221251",
"id": "CVE-2025-38136-09675360",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "usbhs_probe",
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"function_hash": "41158283732428810148595393102058592943",
"length": 2997.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bab152e817fd41b9e178fa6b275354795c9703d",
"id": "CVE-2025-38136-1368f1f9",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"264986780222052674956644721601570052191",
"125766400760679785269770287695468574841",
"188167763820291541442409163928670193379",
"30418717116197361941842474267934533364",
"270109926356213927569996951915096807851",
"190149608322504015384978316810836539233",
"160324447923232264204205398331398972674",
"291489572050984341644028668632837736267",
"272711258461135838940950182850146138939",
"269906310193200827130338154383487419610",
"131382431371609422560676338362365780914",
"318284857390819873368511163610187972594",
"297444425735047218910747663038360765399",
"335123189438030593606307961021261845427",
"306490396630439858562105215798622158010",
"148472413121974973410798689314138786791",
"335175412148884231066943606603678247806",
"225591372830896009213287093499706305050",
"207284125949828608951353656615683379537",
"301837810291221277030379320061356260331",
"45599851885798156559997173788525741107",
"267480140031702971417815627469384594666",
"284542752114241238479032229257246054486",
"76907967098803128728810106094538169007",
"314048709310594929932761850070495427063",
"83397051395954615702364238965532344906",
"3024979699033864674579390572535691016",
"274095389865899061567561100676517451101",
"36391368185211147399467017454564662800",
"106161869656514207072591953290605435113",
"108332068046157956495852066694328447492",
"89464975240312824608972942258646946237",
"304751882612601929999994441025971860438"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a1e16a6cbf4452b46f20b862d6141a1e90844ee",
"id": "CVE-2025-38136-2512eb63",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "usbhs_probe",
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"function_hash": "85898479137065799768320325035806077418",
"length": 3204.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a1e16a6cbf4452b46f20b862d6141a1e90844ee",
"id": "CVE-2025-38136-41792bdc",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"264986780222052674956644721601570052191",
"125766400760679785269770287695468574841",
"188167763820291541442409163928670193379",
"30418717116197361941842474267934533364",
"270109926356213927569996951915096807851",
"190149608322504015384978316810836539233",
"160324447923232264204205398331398972674",
"291489572050984341644028668632837736267",
"272711258461135838940950182850146138939",
"269906310193200827130338154383487419610",
"131382431371609422560676338362365780914",
"318284857390819873368511163610187972594",
"297444425735047218910747663038360765399",
"335123189438030593606307961021261845427",
"306490396630439858562105215798622158010",
"148472413121974973410798689314138786791",
"335175412148884231066943606603678247806",
"225591372830896009213287093499706305050",
"207284125949828608951353656615683379537",
"301837810291221277030379320061356260331",
"45599851885798156559997173788525741107",
"267480140031702971417815627469384594666",
"284542752114241238479032229257246054486",
"76907967098803128728810106094538169007",
"314048709310594929932761850070495427063",
"83397051395954615702364238965532344906",
"3024979699033864674579390572535691016",
"274095389865899061567561100676517451101",
"36391368185211147399467017454564662800",
"106161869656514207072591953290605435113",
"108332068046157956495852066694328447492",
"89464975240312824608972942258646946237",
"304751882612601929999994441025971860438"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bab152e817fd41b9e178fa6b275354795c9703d",
"id": "CVE-2025-38136-460e73e2",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "usbhs_probe",
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"function_hash": "41158283732428810148595393102058592943",
"length": 2997.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1637623ad6205162b17804d07512e6f4cbd2a050",
"id": "CVE-2025-38136-47265659",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"264986780222052674956644721601570052191",
"125766400760679785269770287695468574841",
"188167763820291541442409163928670193379",
"30418717116197361941842474267934533364",
"270109926356213927569996951915096807851",
"190149608322504015384978316810836539233",
"160324447923232264204205398331398972674",
"291489572050984341644028668632837736267",
"272711258461135838940950182850146138939",
"269906310193200827130338154383487419610",
"131382431371609422560676338362365780914",
"318284857390819873368511163610187972594",
"297444425735047218910747663038360765399",
"335123189438030593606307961021261845427",
"306490396630439858562105215798622158010",
"148472413121974973410798689314138786791",
"335175412148884231066943606603678247806",
"225591372830896009213287093499706305050",
"207284125949828608951353656615683379537",
"301837810291221277030379320061356260331",
"45599851885798156559997173788525741107",
"267480140031702971417815627469384594666",
"284542752114241238479032229257246054486",
"76907967098803128728810106094538169007",
"314048709310594929932761850070495427063",
"83397051395954615702364238965532344906",
"3024979699033864674579390572535691016",
"274095389865899061567561100676517451101",
"36391368185211147399467017454564662800",
"106161869656514207072591953290605435113",
"108332068046157956495852066694328447492",
"89464975240312824608972942258646946237",
"304751882612601929999994441025971860438"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@095cc0b5888acc228f12344e85b17539b9ce9367",
"id": "CVE-2025-38136-6c052c66",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"264986780222052674956644721601570052191",
"125766400760679785269770287695468574841",
"188167763820291541442409163928670193379",
"30418717116197361941842474267934533364",
"270109926356213927569996951915096807851",
"190149608322504015384978316810836539233",
"160324447923232264204205398331398972674",
"291489572050984341644028668632837736267",
"272711258461135838940950182850146138939",
"269906310193200827130338154383487419610",
"219217774738613626905742057464441497609",
"175133656998738630114726729815693074211",
"188722940112750705708787805414547371227",
"201225367433533778146647905649063785532",
"306490396630439858562105215798622158010",
"148472413121974973410798689314138786791",
"335175412148884231066943606603678247806",
"225591372830896009213287093499706305050",
"207284125949828608951353656615683379537",
"301837810291221277030379320061356260331",
"45599851885798156559997173788525741107",
"267480140031702971417815627469384594666",
"284542752114241238479032229257246054486",
"76907967098803128728810106094538169007",
"314048709310594929932761850070495427063",
"83397051395954615702364238965532344906",
"3024979699033864674579390572535691016",
"274095389865899061567561100676517451101",
"36391368185211147399467017454564662800",
"106161869656514207072591953290605435113",
"108332068046157956495852066694328447492",
"89464975240312824608972942258646946237",
"304751882612601929999994441025971860438"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffb34a60ce86656ba12d46e91f1ccc71dd221251",
"id": "CVE-2025-38136-6e8ea66a",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"264986780222052674956644721601570052191",
"125766400760679785269770287695468574841",
"188167763820291541442409163928670193379",
"30418717116197361941842474267934533364",
"270109926356213927569996951915096807851",
"190149608322504015384978316810836539233",
"160324447923232264204205398331398972674",
"291489572050984341644028668632837736267",
"272711258461135838940950182850146138939",
"269906310193200827130338154383487419610",
"131382431371609422560676338362365780914",
"318284857390819873368511163610187972594",
"297444425735047218910747663038360765399",
"335123189438030593606307961021261845427",
"306490396630439858562105215798622158010",
"148472413121974973410798689314138786791",
"335175412148884231066943606603678247806",
"225591372830896009213287093499706305050",
"207284125949828608951353656615683379537",
"301837810291221277030379320061356260331",
"45599851885798156559997173788525741107",
"267480140031702971417815627469384594666",
"284542752114241238479032229257246054486",
"76907967098803128728810106094538169007",
"314048709310594929932761850070495427063",
"83397051395954615702364238965532344906",
"3024979699033864674579390572535691016",
"274095389865899061567561100676517451101",
"36391368185211147399467017454564662800",
"106161869656514207072591953290605435113",
"108332068046157956495852066694328447492",
"89464975240312824608972942258646946237",
"304751882612601929999994441025971860438"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db96a4fd8614d47c0def265e0e6c996b0ee52a38",
"id": "CVE-2025-38136-6f7418d8",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "usbhs_probe",
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"function_hash": "325055416306134821895809341678030058518",
"length": 3022.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4c368e4a638ddf4a9d6d687b0ff691aa46cce53",
"id": "CVE-2025-38136-9e3c19b8",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "usbhs_probe",
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"function_hash": "41158283732428810148595393102058592943",
"length": 2997.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4c368e4a638ddf4a9d6d687b0ff691aa46cce53",
"id": "CVE-2025-38136-a06b72b8",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"264986780222052674956644721601570052191",
"125766400760679785269770287695468574841",
"188167763820291541442409163928670193379",
"30418717116197361941842474267934533364",
"270109926356213927569996951915096807851",
"190149608322504015384978316810836539233",
"160324447923232264204205398331398972674",
"291489572050984341644028668632837736267",
"272711258461135838940950182850146138939",
"269906310193200827130338154383487419610",
"131382431371609422560676338362365780914",
"318284857390819873368511163610187972594",
"297444425735047218910747663038360765399",
"335123189438030593606307961021261845427",
"306490396630439858562105215798622158010",
"148472413121974973410798689314138786791",
"335175412148884231066943606603678247806",
"225591372830896009213287093499706305050",
"207284125949828608951353656615683379537",
"301837810291221277030379320061356260331",
"45599851885798156559997173788525741107",
"267480140031702971417815627469384594666",
"284542752114241238479032229257246054486",
"76907967098803128728810106094538169007",
"314048709310594929932761850070495427063",
"83397051395954615702364238965532344906",
"3024979699033864674579390572535691016",
"274095389865899061567561100676517451101",
"36391368185211147399467017454564662800",
"106161869656514207072591953290605435113",
"108332068046157956495852066694328447492",
"89464975240312824608972942258646946237",
"304751882612601929999994441025971860438"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1637623ad6205162b17804d07512e6f4cbd2a050",
"id": "CVE-2025-38136-b7dac608",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "usbhs_probe",
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"function_hash": "325055416306134821895809341678030058518",
"length": 3022.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db96a4fd8614d47c0def265e0e6c996b0ee52a38",
"id": "CVE-2025-38136-ba08b16f",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"264986780222052674956644721601570052191",
"125766400760679785269770287695468574841",
"188167763820291541442409163928670193379",
"30418717116197361941842474267934533364",
"270109926356213927569996951915096807851",
"190149608322504015384978316810836539233",
"160324447923232264204205398331398972674",
"291489572050984341644028668632837736267",
"272711258461135838940950182850146138939",
"269906310193200827130338154383487419610",
"131382431371609422560676338362365780914",
"318284857390819873368511163610187972594",
"297444425735047218910747663038360765399",
"335123189438030593606307961021261845427",
"306490396630439858562105215798622158010",
"148472413121974973410798689314138786791",
"335175412148884231066943606603678247806",
"225591372830896009213287093499706305050",
"207284125949828608951353656615683379537",
"301837810291221277030379320061356260331",
"45599851885798156559997173788525741107",
"267480140031702971417815627469384594666",
"284542752114241238479032229257246054486",
"76907967098803128728810106094538169007",
"314048709310594929932761850070495427063",
"83397051395954615702364238965532344906",
"3024979699033864674579390572535691016",
"274095389865899061567561100676517451101",
"36391368185211147399467017454564662800",
"106161869656514207072591953290605435113",
"108332068046157956495852066694328447492",
"89464975240312824608972942258646946237",
"304751882612601929999994441025971860438"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@155453ada562c450a4ff5fcf4852b9fa5b6b793a",
"id": "CVE-2025-38136-d4886dc5",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "usbhs_probe",
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"function_hash": "85898479137065799768320325035806077418",
"length": 3204.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@155453ada562c450a4ff5fcf4852b9fa5b6b793a",
"id": "CVE-2025-38136-f281ad8f",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"264986780222052674956644721601570052191",
"125766400760679785269770287695468574841",
"188167763820291541442409163928670193379",
"30418717116197361941842474267934533364",
"270109926356213927569996951915096807851",
"190149608322504015384978316810836539233",
"160324447923232264204205398331398972674",
"291489572050984341644028668632837736267",
"272711258461135838940950182850146138939",
"269906310193200827130338154383487419610",
"131382431371609422560676338362365780914",
"318284857390819873368511163610187972594",
"297444425735047218910747663038360765399",
"335123189438030593606307961021261845427",
"306490396630439858562105215798622158010",
"148472413121974973410798689314138786791",
"335175412148884231066943606603678247806",
"225591372830896009213287093499706305050",
"207284125949828608951353656615683379537",
"301837810291221277030379320061356260331",
"45599851885798156559997173788525741107",
"267480140031702971417815627469384594666",
"284542752114241238479032229257246054486",
"76907967098803128728810106094538169007",
"314048709310594929932761850070495427063",
"83397051395954615702364238965532344906",
"3024979699033864674579390572535691016",
"274095389865899061567561100676517451101",
"36391368185211147399467017454564662800",
"106161869656514207072591953290605435113",
"108332068046157956495852066694328447492",
"89464975240312824608972942258646946237",
"304751882612601929999994441025971860438"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@095cc0b5888acc228f12344e85b17539b9ce9367",
"id": "CVE-2025-38136-fc722017",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "usbhs_probe",
"file": "drivers/usb/renesas_usbhs/common.c"
},
"digest": {
"function_hash": "303394541752405159170114782213071429679",
"length": 3467.0
}
}
]