CVE-2025-38010

What it actually does

Race condition in Tegra xUSB UTMI pad power state tracking where a shared reference count (bias_pad_enable) is decremented without verifying current state, producing mismatches and kernel warnings during suspend with connected USB devices.

Why it matters to the business

Low operational impact limited to spurious warnings and potential power-management unreliability on suspend/resume cycles for Tegra-based Linux systems; no widespread exploitation observed after 496 days with stable low EPSS and no KEV listing.

How an attack unfolds

An attacker with the ability to initiate system suspend while USB devices remain connected can trigger unbalanced power-down calls in the UTMI pad logic originally introduced by dynamic power control changes, resulting in reference-count warnings; no known threat actors have leveraged this for privilege escalation or ransomware.

How to fix it

Update the Linux kernel to the fixed commit ba25131b3c1ceec303839b2462586d7673788197 (or equivalent stable branch) which replaces the reference counter with a per-PHY bitmask (utmi_pad_enabled) and relocates mutex protection to the parent pad power functions.

How to confirm the fix worked

Boot the patched kernel, perform multiple suspend/resume cycles with USB devices connected, and confirm absence of tegra186_utmi_pad_power_down warnings; inspect source for utmi_pad_enabled bitmask usage and mutex placement in tegra186_utmi_pad_power_on/down.

Typical attack path

1. Obtain local access or trigger legitimate suspend on a Tegra platform with USB devices attached
2. Invoke platform_pm_suspend path reaching tegra_xusb_enter_elpg
3. Cause multiple tegra186_utmi_pad_power_down calls without matching power-on operations
4. Observe reference-count mismatch warnings in dmesg

How to detect it

Search kernel logs and dmesg for the call trace beginning at tegra186_utmi_pad_power_down during suspend events; correlate with platform_pm_suspend and phy_power_off entries around the same timestamp.

• tegra186_utmi_pad_power_down+0x160/0x170
• tegra186_utmi_phy_power_off+0x10/0x30
• WARNING: CPU: .* at tegra186_utmi_pad_power_down

What your security team should do

• Prioritize kernel upgrade on Tegra-based embedded or automotive systems within normal maintenance windows
• Add the specific suspend-path warning strings to centralized logging alerts
• Review downstream device trees or vendor kernels for similar reference-count patterns