CVE-2025-71200
Clock Frequency Reduction Vulnerability in Linux MMC SDHCI Driver
Publication date: 2026-02-14
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.122 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.68 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.8 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.0 (inc) to 6.1.162 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's MMC (MultiMediaCard) subsystem, specifically in the sdhci-of-dwcmshc driver for the Rockchip DWC MSHC controller. When operating in HS200 or HS400 timing modes, reducing the clock frequency below 52MHz causes the link to break because the controller requires a minimum clock frequency of 52MHz in these modes.
The vulnerability allows an illegal clock reduction through debugfs, which can disrupt the MMC link and cause errors or failures in the system's handling of MMC devices.
How can this vulnerability impact me? :
If this vulnerability is exploited, it can cause the MMC link to break when the clock frequency is reduced below the required minimum of 52MHz in HS200 or HS400 modes. This can lead to system instability, errors in MMC device communication, and potential data access or transfer failures.
Such disruptions could affect the reliability of storage devices relying on this controller, potentially causing system crashes or degraded performance.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reduce the clock frequency below 52MHz on the affected MMC device operating in HS200 or HS400 timing modes and observing the system's response.
For example, you can use the following command to test the clock frequency setting via debugfs:
- echo 50000000 > /sys/kernel/debug/mmc0/clock
If the vulnerability is present, the system will log warnings and errors such as "mmc0: running CQE recovery", "cqhci: Failed to halt", and kernel warnings related to cqhci_irq.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the clock frequency for MMC devices operating in HS200 or HS400 modes is not reduced below 52MHz.
This can be enforced by applying the patch that adds a check to prevent illegal clock reduction through debugfs, as described in the vulnerability fix.
Additionally, monitor system logs for any warnings or errors related to clock frequency settings on MMC devices and avoid manual clock reductions below the minimum threshold.