CVE-2025-71193: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71193 is a NULL pointer dereference vulnerability in the Linux kernel's phy-qcom-qusb2 driver, caused by a race condition during device initialization. Enabling runtime PM before attaching the QPHY instance as driver data creates a brief window where the qusb2_phy_runtime_suspend callback can execute with a NULL driver data pointer, resulting in a sporadic kernel crash during boot. The vulnerability affects Linux kernel versions from 4.17 up to (but not including) the patched stable releases (6.6.122, 6.12.67, 6.18.7, and 6.19-rc6). It was published on February 4, 2026, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a NULL pointer dereference (CWE-476) in the qusb2_phy_runtime_suspend function within the phy_qcom_qusb2 kernel module. The driver previously called pm_runtime_enable() before setting the QPHY instance as driver data via platform_set_drvdata(), leaving a race window where the PM workqueue (kworker/0:1) could invoke the suspend callback before valid driver data was available. The fix reorders initialization so the QPHY instance is attached as driver data first, then runtime PM is enabled, and switches to the devres-managed PM runtime API to ensure symmetric cleanup on driver removal (Feedly, Linux Kernel Stable).

Successful triggering of this vulnerability causes a kernel panic (system crash) on affected devices using Qualcomm QUSB2 PHY hardware, resulting in a denial of service. The crash is sporadic and occurs during boot, making affected systems unreliable or unbootable in certain timing conditions. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss on devices with the affected PHY driver (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-71193. The vulnerability is a local, hardware-specific race condition triggered during kernel boot on devices with Qualcomm QUSB2 PHY hardware, significantly limiting its attack surface. The EPSS score is approximately 0.018%, reflecting very low exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs/Kernel Messages: Kernel oops messages referencing qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2] and pm_generic_runtime_suspend+0x2c/0x44 in dmesg or /var/log/kern.log.
• Logs/Kernel Messages: Messages indicating Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1 during boot, with workqueue context kworker/0:1 and process pm_runtime_work.
• System Behavior: Sporadic system crashes or reboots during boot on devices using Qualcomm QUSB2 PHY hardware (e.g., certain Qualcomm Snapdragon-based platforms).

The Linux kernel maintainers have released fixes in stable branches: 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6. The fix reorders driver initialization to attach the QPHY instance as driver data before enabling runtime PM, and adopts the devres-managed PM runtime API. Users running affected kernel versions on Qualcomm QUSB2 PHY hardware should update to a patched kernel version. Ubuntu has issued security notices USN-8278-1, USN-8278-2, USN-8289-1, USN-8289-2, USN-8296-1, USN-8296-2, and USN-8393-1 addressing this and related kernel vulnerabilities (Ubuntu USN-8278-1, Ubuntu USN-8296-1, Linux Kernel Stable).