CVE-2025-40113
Description
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E
The ADSP firmware on X1E has separate firmware binaries for the main firmware and the DTB. The same applies for the "lite" firmware loaded by the boot firmware.
When preparing to load the new ADSP firmware we shutdown the lite_pas_id for the main firmware, but we don't shutdown the corresponding lite pas_id for the DTB. The fact that we're leaving it "running" forever becomes obvious if you try to reuse (or just access) the memory region used by the "lite" firmware: The &adsp_boot_mem is accessible, but accessing the &adsp_boot_dtb_mem results in a crash.
We don't support reusing the memory regions currently, but nevertheless we should not keep part of the lite firmware running. Fix this by adding the lite_dtb_pas_id and shutting it down as well.
We don't have a way to detect if the lite firmware is actually running yet, so ignore the return status of qcom_scm_pas_shutdown() for now. This was already the case before, the assignment to "ret" is not used anywhere.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Missing shutdown of ADSP DTB lite firmware on X1E can crash the kernel; fix adds proper shutdown.
In the Linux kernel's remoteproc qcom pas driver, when preparing to load new ADSP firmware on X1E, the lite_pas_id for the main firmware is shutdown, but the corresponding lite pas_id for the DTB firmware is not, leaving it in a running state [1]. This inconsistency means that accessing the memory region (&adsp_boot_dtb_mem) used by the lite DTB firmware can result in a crash [1].
Exploitation of this vulnerability requires the ability to trigger a firmware reload operation, which is typically a privileged action. No authentication is needed beyond standard kernel access, but the attack surface is limited to local users or processes that can initiate SCM calls to the remoteproc subsystem. The issue is specific to the X1E platform with separate ADSP firmware binaries.
The impact is a denial of service: accessing the affected memory region causes a system crash. While memory region reuse is not currently supported, the lingering firmware state is a latent bug that can be triggered under normal operation.
The fix has been applied to the Linux kernel stable tree via commit 142964960c7c [1]. Users are advised to update to a kernel version containing this patch to prevent potential crashes.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
2ee150acd273a142964960c7cVulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.