Cloudanix VulnDB

CVE-2025-22011

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Apr 8, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A configuration error in certain Raspberry Pi hardware setups can cause the system to crash when waking from sleep, and updating the software fixes the problem.

Exploitation
Requires User Interaction
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Misconfiguration
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes the VPU firmware to crash on xHCI power-domain resume during s2idle due to simultaneous use of raspberrypi-power and bcm2835-power drivers on bcm2711-based systems.

Why it matters to the business

Embedded devices such as Raspberry Pi Compute Module 4 experience crashes or failures during suspend/resume cycles, reducing system reliability and availability in production deployments.

How an attack unfolds

An attacker or routine power-management operation initiates a suspend-to-idle transition; the conflicting power-domain handling for the xHCI controller causes the VPU firmware to fail to restore power, resulting in a crash.

How to fix it

Update the Linux kernel to a version containing commit b8a47aa0b3df701d0fc41b3caf78d00571776be0 or later; for affected Red Hat packages apply firefox 102.4.0-1.el8_1 or newer where applicable.

How to confirm the fix worked

Verify the updated device-tree source no longer references the VPU firmware power-domain for xHCI; re-run s2idle tests and confirm absence of the 'Failed to set power to 1' error.

Typical attack path

  1. Trigger s2idle via /sys/power/state
  2. Observe xhci_suspend and bcm2835-power power-off sequence
  3. On resume, VPU firmware fails to set USB power domain to on
  4. Kernel logs show timeout and system instability

How to detect it

Review kernel logs for 'Failed to set power to 1 (-110)' and 'VPU firmware always crashes on xHCI power-domain resume' messages after suspend/resume cycles.

What your security team should do

  • Prioritize kernel updates on all bcm2711-based systems within the next maintenance window
  • Add s2idle regression tests to CI pipelines for ARM64 embedded kernels
  • Monitor vendor advisories for downstream Raspberry Pi kernel releases

The record

In the Linux kernel, the following vulnerability has been resolved: ARM: dts: bcm2711: Fix xHCI power-domain During s2idle tests on the Raspberry CM4 the VPU firmware always crashes on xHCI power-domain resume: root@raspberrypi:/sys/power# echo freeze > state [ 70.724347] xhci_suspend finished [ 70.727730] xhci_plat_suspend finished [ 70.755624] bcm2835-power bcm2835-power: Power grafx off [ 70.761127] USB: Set power to 0 [ 74.653040] USB: Failed to set power to 1 (-110) This seems to be caused because of the mixed usage of raspberrypi-power and bcm2835-power at the same time. So avoid the usage of the VPU firmware power-domain driver, which prevents the VPU crash.

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 6.12.21-1
Linux Kernel 6.8.0 6.12.21

Related vulnerabilities