# CVE-2025-68236: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)

> A race condition in the Qualcomm UFS driver during power-down can trigger regulator overcurrent protection, causing a denial of service.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 16 Dec 2025
- **Updated:** 21 Oct 2026
- **Also known as:** BELL-CVE-2025-68236, DEBIAN-CVE-2025-68236, GHSA-rmcq-qm8v-8r2p, ROOT-OS-DEBIAN-11-CVE-2025-68236, ROOT-OS-DEBIAN-12-CVE-2025-68236, ROOT-OS-DEBIAN-13-CVE-2025-68236, ROOT-OS-UBUNTU-2204-CVE-2025-68236, ROOT-OS-UBUNTU-2404-CVE-2025-68236, UBUNTU-CVE-2025-68236

## What is CVE-2025-68236?

CVE-2025-68236 is a denial of service vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)

According to UFS specifications, the power-off sequence for a UFS device
includes:

 - Sending an SSU command with Power_Condition=3 and await a response.

 - Asserting RST_N low.

 - Turning off REF_CLK.

 - Turning off VCC.

 - Turning off VCCQ/VCCQ2.

As part of ufs shutdown, after the SSU command completion, asserting
hardware reset (HWRST) triggers the device firmware to wake up and
execute its reset routine. This routine initializes hardware blocks and
takes a few milliseconds to complete. During this time, the ICCQ draws a
large current.

This large ICCQ current may cause issues for the regulator which is
supplying power to UFS, because the turn off request from UFS driver to
the regulator framework will be immediately followed by low power
mode(LPM) request by regulator framework. This is done by framework
because UFS which is the only client is requesting for disable. So if
the rail is still in the process of shutting down while ICCQ exceeds LPM
current thresholds, and LPM mode is activated in hardware during this
state, it may trigger an overcurrent protection (OCP) fault in the
regulator.

To prevent this, a 10ms delay is added after asserting HWRST. This
allows the reset operation to complete while power rails remain active
and in high-power mode.

Currently there is no way for Host to query whether the reset is
completed or not and hence this the delay is based on experiments with
Qualcomm UFS controllers across multiple UFS vendors.

## Which versions are affected by CVE-2025-68236?


## How do I fix CVE-2025-68236?

Apply the vendor's patch.

## Is CVE-2025-68236 being exploited?

There is no known exploitation of CVE-2025-68236 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-68236 and fix it if it is affected.

What it is: CVE-2025-68236 is a denial of service vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-68236 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-68236/ (Markdown: https://insights.sbomify.com/CVE-2025-68236/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-68236
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-68236
- OSV: https://osv.dev/vulnerability/CVE-2025-68236

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-68236/
Summaries are generated and may contain mistakes; the official description above is the record.