CVE-2025-71200: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71200 is a denial-of-service vulnerability in the Linux kernel's mmc: sdhci-of-dwcmshc driver that allows a local user with low privileges to trigger a storage controller link failure by reducing the MMC clock frequency below the required minimum via the debugfs interface. The vulnerability affects Linux kernel versions 6.0–6.1.161, 6.2–6.6.121, 6.7–6.12.67, and 6.13–6.18.7, as well as pre-release versions 6.19-rc1 through 6.19-rc6. It was published on February 14, 2026, with patches released on March 18, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Feedly).

The root cause is an improper input validation (CWE-20) issue in the sdhci-of-dwcmshc driver for Rockchip DWC MSHC controllers. When the MMC controller operates in HS200 or HS400 timing modes, it requires a minimum clock frequency of 52 MHz; the driver previously lacked a guard against clock reductions below this threshold via the debugfs clock interface. An attacker with local access and low privileges can write a value below 52,000,000 to /sys/kernel/debug/mmc0/clock, causing the controller link to break, triggering CQE (Command Queue Engine) recovery failures, spurious interrupt handling (cqhci_irq), and kernel warnings (Feedly, Kernel Patch).

Successful exploitation results in a denial-of-service condition affecting the eMMC/SD card storage subsystem. The storage controller enters a broken link state, causing CQE recovery failures and kernel warnings that disrupt any workloads relying on eMMC/SD card functionality. There is no confidentiality or integrity impact; the vulnerability is limited to availability, primarily affecting Rockchip RK3588-based devices and similar embedded/SBC platforms running affected kernel versions (Feedly).

1. Gain local access: Obtain a local shell on a system running an affected Linux kernel version (6.0–6.1.161, 6.2–6.6.121, 6.7–6.12.67, or 6.13–6.18.7) with a Rockchip DWC MSHC controller, with at least low-privilege user access.
2. Verify debugfs is mounted: Confirm that debugfs is mounted at /sys/kernel/debug (e.g., mount | grep debugfs).
3. Confirm HS200/HS400 mode: Check that the MMC controller is operating in HS200 or HS400 timing mode (e.g., via cat /sys/kernel/debug/mmc0/ios).
4. Write a sub-threshold clock value: Execute echo 50000000 > /sys/kernel/debug/mmc0/clock to set the clock below the 52 MHz minimum.
5. Trigger denial of service: The controller link breaks, causing CQE recovery failures, spurious TCN interrupts, and kernel warnings in cqhci-core.c, resulting in storage subsystem unavailability (Feedly).

• Logs: Kernel log entries containing mmc0: running CQE recovery, mmc0: cqhci: Failed to halt, and mmc0: cqhci: spurious TCN for tag 0; kernel WARNING at drivers/mmc/host/cqhci-core.c:797 in cqhci_irq.
• File System: Unexpected or unauthorized writes to /sys/kernel/debug/mmc0/clock with values below 52,000,000 (52 MHz); audit logs showing write access to this debugfs path by non-root or low-privilege users.
• Process: Unusual processes (e.g., shell scripts or automation tools) writing to debugfs MMC clock interfaces; kworker threads consuming elevated CPU due to repeated CQE recovery attempts.

Patched kernel versions are available: 6.1.162, 6.6.122, 6.12.68, and 6.18.8. Administrators should upgrade to one of these fixed versions as the primary remediation. As a workaround, restrict write access to the debugfs interface by limiting debugfs mount permissions or disabling debugfs entirely in production environments where it is not operationally required (CONFIG_DEBUG_FS=n or unmounting debugfs). Additionally, enforce strict local access controls to prevent low-privilege users from accessing /sys/kernel/debug/ (Feedly, Kernel Patch).

The vulnerability has been addressed in SUSE and Ubuntu security advisories, with distribution-level kernel updates issued for affected versions. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability, consistent with its medium severity and limited exploitation potential (Linux Security SUSE, Ubuntu USN-8278-1).