CVE-2025-38535

phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode

HIGH

7.8

CVSS Score

Published: August 16, 2025 at 11:12 AM UTC

Updated: June 17, 2026 at 09:17 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-on, regulator_is_enabled() continues to return true, leading to an incorrect attempt to disable a regulator which is not enabled. This can result in warnings such as: [ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004 _regulator_disable+0xe4/0x1a0 [ 250.155652] unbalanced disables for VIN_SYS_5V0 To fix this, we move the regulator control logic into tegra186_xusb_padctl_id_override() function since it's directly related to the ID override state. The regulator is now only disabled when the role transitions from USB_ROLE_HOST to USB_ROLE_NONE, by checking the VBUS_ID register. This ensures that regulator enable/disable operations are properly balanced and only occur when actually transitioning to/from host mode.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

5.11 ≤ v < 5.15.1905.16 ≤ v < 6.1.1475.7 ≤ v < 5.10.2415.7 ≤ v < 5.15.1905.7 ≤ v < 6.1.1475.7 ≤ v < 6.12.405.7 ≤ v < 6.15.85.7 ≤ v < 6.165.7 ≤ v < 6.6.1006.13 ≤ v < 6.15.86.2 ≤ v < 6.6.1006.7 ≤ v < 6.12.4049d46e3c7e597e8b00c6fc16e6fd7a92044f43715.7 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 6.16 rc5 6.16 rc6

Vendor states this is fixed in 1bb85b5c2bd43b687c3d54eb6328917f90dd38fc (fixed)

Vendor states this is fixed in 5367cdeb75cb6c687ca468450bceb2602ab239d8 (fixed)

Vendor states this is fixed in cdcb0ffd6448f6be898956913a42bd08e59fb2ae (fixed)

Vendor states this is fixed in ceb645ac6ce052609ee5c8f819a80e8881789b04 (fixed)

Vendor states this is fixed in cefc1caee9dd06c69e2d807edc5949b329f52b22 (fixed)

Vendor states this is fixed in eaa420339658615d26c1cc95cd6cf720b9aebfca (fixed)

Vendor states this is fixed in ec7f98ff05f0649af0adeb4808c7ba23d6111ef9 (fixed)

Vendor states this is fixed in 5.10.241 (unaffected)

Vendor states this is fixed in 5.15.190 (unaffected)

Vendor states this is fixed in 5.7 (unaffected)

Vendor states this is fixed in 6.1.147 (unaffected)

Vendor states this is fixed in 6.12.40 (unaffected)