usb: renesas_usbhs: Reorder clock handling and power management in probe

{
  "id": "62711780af7d79540eead3cb1428336a626e9dd9fa6ff3a2cc3df450743ea2d9",
  "url": "https://osv.dev/vulnerability/CVE-2025-38136",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "usb: renesas_usbhs: Reorder clock handling and power management in probe",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in `usbhs_probe()` to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks. Currently, in the probe path, registers are accessed before enabling the clocks, leading to a synchronous external abort on the RZ/V2H SoC. The problematic call flow is as follows: usbhs_probe() usbhs_sys_clock_ctrl() usbhs_bset() usbhs_write() iowrite16() <-- Register access before enabling clocks Since `iowrite16()` is performed without ensuring the required clocks are enabled, this can lead to access errors. To fix this, enable PM runtime early in the probe function and ensure clocks are acquired before register access, preventing crashes like the following on RZ/V2H: [13.272640] Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP [13.280814] Modules linked in: cec renesas_usbhs(+) drm_kms_helper fuse drm backlight ipv6 [13.289088] CPU: 1 UID: 0 PID: 195 Comm: (udev-worker) Not tainted 6.14.0-rc7+ #98 [13.296640] Hardware name: Renesas RZ/V2H EVK Board based on r9a09g057h44 (DT) [13.303834] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [13.310770] pc : usbhs_bset+0x14/0x4c [renesas_usbhs] [13.315831] lr : usbhs_probe+0x2e4/0x5ac [renesas_usbhs] [13.321138] sp : ffff8000827e3850 [13.324438] x29: ffff8000827e3860 x28: 0000000000000000",
    "evidence": "osv:CVE-2025-38136",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.4.295",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.239",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.186",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.142",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.94",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.34",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.15.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2025-38136",
      "aliases": [
        "CVE-2025-38136"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647"
                },
                {
                  "fixed": "095cc0b5888acc228f12344e85b17539b9ce9367"
                },
                {
                  "fixed": "155453ada562c450a4ff5fcf4852b9fa5b6b793a"
                },
                {
                  "fixed": "0a1e16a6cbf4452b46f20b862d6141a1e90844ee"
                },
                {
                  "fixed": "1637623ad6205162b17804d07512e6f4cbd2a050"
                },
                {
                  "fixed": "db96a4fd8614d47c0def265e0e6c996b0ee52a38"
                },
                {
                  "fixed": "d4c368e4a638ddf4a9d6d687b0ff691aa46cce53"
                },
                {
                  "fixed": "6bab152e817fd41b9e178fa6b275354795c9703d"
                },
                {
                  "fixed": "ffb34a60ce86656ba12d46e91f1ccc71dd221251"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38136.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "3.0.0"
                },
                {
                  "fixed": "5.4.295"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.239"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.186"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.142"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.94"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.34"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.15.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38136.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.774293922Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/095cc0b5888acc228f12344e85b17539b9ce9367",
        "https://git.kernel.org/stable/c/0a1e16a6cbf4452b46f20b862d6141a1e90844ee",
        "https://git.kernel.org/stable/c/155453ada562c450a4ff5fcf4852b9fa5b6b793a",
        "https://git.kernel.org/stable/c/1637623ad6205162b17804d07512e6f4cbd2a050",
        "https://git.kernel.org/stable/c/6bab152e817fd41b9e178fa6b275354795c9703d",
        "https://git.kernel.org/stable/c/d4c368e4a638ddf4a9d6d687b0ff691aa46cce53",
        "https://git.kernel.org/stable/c/db96a4fd8614d47c0def265e0e6c996b0ee52a38",
        "https://git.kernel.org/stable/c/ffb34a60ce86656ba12d46e91f1ccc71dd221251",
        "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
        "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38136.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-38136",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38136.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-38136",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 497418,
  "published_at": "2025-07-03T08:35:39.207+00:00"
}