CVE-2025-22012

In the Linux kernel, the following vulnerability has been resolved:

Revert "arm64: dts: qcom: sdm845: Affirm IDR0.CCTW on apps_smmu"

There are reports that the pagetable walker cache coherency is not a given across the spectrum of SDM845/850 devices, leading to lock-ups and resets. It works fine on some devices (like the Dragonboard 845c, but not so much on the Lenovo Yoga C630).

This unfortunately looks like a fluke in firmware development, where likely somewhere in the vast hypervisor stack, a change to accommodate for this was only introduced after the initial software release (which often serves as a baseline for products).

Revert the change to avoid additional guesswork around crashes.

This reverts commit 6b31a9744b8726c69bb0af290f8475a368a4b805.

A flaw was found in the Linux kernel's Qualcomm SDM845/850 platform support, where the device tree affirmed IDR0.CCTW (page-table walker cache coherency) on the apps_smmu. Because page-table walker cache coherency is not guaranteed across the spectrum of SDM845/850 devices, with variance apparently stemming from device-specific firmware/hypervisor behavior, this configuration could cause device lock-ups and resets on affected hardware (for example, the Lenovo Yoga C630), while other devices such as the Dragonboard 845c operated normally. Red Hat assesses the impact of this issue as Low: it is a local, availability-only issue confined to specific ARM hardware, with no confidentiality or integrity impact, and it does not provide code execution or privilege escalation. The upstream resolution reverts the offending device-tree change to avoid crashes. Red Hat Enterprise Linux (including kernel and kernel-rt across all supported streams), Red Hat In-Vehicle OS, and Red Hat managed/hosted OpenShift products are marked not affected because the vulnerable code is not present in the shipped kernels. The CVE.org CVSS score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) overstates the risk relative to Red Hat's assessment, as the issue affects only system availability on specific Qualcomm hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.