In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: cmd-db: Map shared memory as WC, not WB
Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache eviction as "write" into the write protected region leading to secure interrupt which causes an endless loop somewhere in Trust Zone.
The only reason it is working right now is because Qualcomm Hypervisor maps the same region as Non-Cacheable memory in Stage 2 translation tables. The issue manifests if we want to use another hypervisor (like Xen or KVM), which does not know anything about those specific mappings.
Changing the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC removes dependency on correct mappings in Stage 2 tables. This patch fixes the issue by updating the mapping to MEMREMAP_WC.
I tested this on SA8155P with Xen.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-modules-coreUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-develUpgrade perfUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-docUpgrade kernel-64k-debug-develUpgrade kernel-debugUpgrade python3-perfUpgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-rt-64k-debug-develUpgrade rtlaUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-64k-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-64k-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rtUpgrade rvUpgrade kernelUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-modulesUpgrade kernel-64kUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64kUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-uki-virtUpgrade kernel-uki-virt-addonsUpgrade kernel-cross-headersUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debug-modules-extraUpgrade libperfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debug | Nov 20, 2025 | Nov 11, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.225-213.878Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-develUpgrade kernel-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.166-111.163 | Sep 27, 2024 | Sep 13, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernel-tools-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-livepatch-6.1.109-118.189Upgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade kernel-develUpgrade kernelUpgrade kernel-libbpf-staticUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-modules-extraUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64 | Feb 17, 2025 | Sep 13, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Oct 7, 2024 | Sep 13, 2024 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Sep 13, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 9, 2025 | Sep 13, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debuginfoUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-coreUpgrade kernel-toolsUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade kernel-zfcpdumpUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-rtUpgrade kernel-debugUpgrade kernel-uki-virtUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade rvUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-develUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-develUpgrade libperfUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-devel-matchedUpgrade perfUpgrade kernel-zfcpdump-develUpgrade kernel-rt-coreUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-uki-virtUpgrade rtlaUpgrade python3-perfUpgrade libperf-debuginfoUpgrade kernel-modules-core | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade dtb-sprdUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-debugUpgrade dlm-kmp-defaultUpgrade kernel-azureUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-develUpgrade dlm-kmp-rtUpgrade dtb-alteraUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-source-rtUpgrade ocfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-defaultUpgrade dtb-marvellUpgrade dtb-rockchipUpgrade dtb-xilinxUpgrade dtb-armUpgrade kernel-default-baseUpgrade dtb-renesasUpgrade dtb-nvidiaUpgrade dtb-amdUpgrade dtb-caviumUpgrade kernel-rt-optionalUpgrade dtb-appleUpgrade kernel-debug-develUpgrade kselftests-kmp-azureUpgrade kernel-rt-livepatchUpgrade dtb-socionextUpgrade kernel-rt_debug-develUpgrade kernel-default-optionalUpgrade kernel-docsUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-64kb-extraUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-default-develUpgrade kernel-64kb-develUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade kernel-macrosUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-extraUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade kernel-default-extraUpgrade kernel-devel-azureUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade dtb-freescaleUpgrade kernel-azure-develUpgrade dtb-amazonUpgrade kernel-devel-rtUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade kernel-symsUpgrade kernel-azure-optionalUpgrade kernel-64kb-optionalUpgrade dtb-broadcomUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade kernel-syms-azureUpgrade kernel-rtUpgrade dtb-amlogicUpgrade kernel-obs-qaUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-mediatekUpgrade dtb-exynosUpgrade dtb-apm | Dec 5, 2025 | Oct 8, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-gke-5.15Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-ibm-classicUpgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-raspi2Upgrade linux-image-5.15.0-1075-azureUpgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-5.4.0-1139-azureUpgrade linux-image-bluefieldUpgrade linux-image-oem-20.04dUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oem-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oem-20.04bUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-5.4.0-200-genericUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-awsUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-5.15.0-1072-awsUpgrade linux-image-aws-lts-20.04Upgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-oem-20.04cUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-intelUpgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-azure-lts-20.04Upgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-gcpUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-generic-lpaeUpgrade linux-image-ibmUpgrade linux-image-5.4.0-1140-azureUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-osp1Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-oemUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-azure-fdeUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-raspiUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-5.4.0-1044-iotUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-azureUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-6.8.0-50-genericUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-oem-22.04dUpgrade linux-image-genericUpgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-1135-aws | Nov 4, 2024 | Sep 13, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Sep 13, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub