CVE-2025-40113: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability has been identified related to the remoteproc subsystem's handling of ADSP DTB on X1E platforms. The issue stems from incomplete shutdown procedures for the lite ADSP DTB firmware components (Debian Security).

The vulnerability occurs when preparing to load new ADSP firmware, where the system shuts down the litepasid for the main firmware but fails to shutdown the corresponding lite pas_id for the DTB. This oversight results in part of the lite firmware remaining active indefinitely, which becomes particularly problematic when attempting to reuse or access the memory region used by the lite firmware (Debian Security).

When attempting to access the memory regions, &adspbootmem remains accessible, but accessing &adspbootdtb_mem results in a system crash. While memory region reuse is not currently supported, the persistent running state of part of the lite firmware presents a security concern (Debian Security).

The issue has been resolved by adding the litedtbpasid and implementing proper shutdown procedures. The fix ignores the return status of qcomscmpasshutdown() temporarily, as there is currently no mechanism to detect if the lite firmware is actually running. The patch has been included in kernel version 6.18-rc1 (Debian Security).