CVE-2025-38093 arm64: dts: qcom: x1e80100: Add GPU cooling
Missing GPU thermal throttling in the Linux kernel for Qualcomm X1E80100 devices can cause hardware shutdowns under high load, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38093?
CVE-2025-38093 is a medium-severity denial of service vulnerability in Linux kernel, published on 2 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm64: dts: qcom: x1e80100: Add GPU cooling
Unlike the CPU, the GPU does not throttle its speed automatically when it reaches high temperatures. With certain high GPU loads it is possible to reach the critical hardware shutdown temperature of 120°C, endangering the hardware and making it impossible to run certain applications.
Set up GPU cooling similar to the ACPI tables, by throttling the GPU speed when reaching 95°C and polling every 200ms.
Which versions are affected by CVE-2025-38093?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38093?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38093 being exploited?
There is no known exploitation of CVE-2025-38093 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38093, DEBIAN-CVE-2025-38093, GHSA-2qcx-76f8-2736, UBUNTU-CVE-2025-38093.