---
id: CVE-2025-71193
title: 'phy: qcom-qusb2: Fix NULL pointer dereference on early suspend'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  phy: qcom-qusb2: Fix NULL pointer dereference on early suspend

  Enabling runtime PM before attaching the QPHY instance as driver data
  can lead to a NULL pointer derefer…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c <
    f8a30ff99ae45d368737993961f7c334c76af5fa
  - >-
    Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c <
    beba460a299150b5d8dcbe3474a8f4bdf0205180
  - >-
    Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c <
    d50a9b7fd07296a1ab81c49ceba14cae3d31df86
  - >-
    Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c <
    4ac15caa27ff842b068a54f1c6a8ff8b31f658e7
  - >-
    Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c <
    1ca52c0983c34fca506921791202ed5bdafd5306
  - Linux 4.17
published: '2026-02-04'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:23:31.285Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71193'
references:
  - url: 'https://git.kernel.org/stable/c/f8a30ff99ae45d368737993961f7c334c76af5fa'
  - url: 'https://git.kernel.org/stable/c/beba460a299150b5d8dcbe3474a8f4bdf0205180'
  - url: 'https://git.kernel.org/stable/c/d50a9b7fd07296a1ab81c49ceba14cae3d31df86'
  - url: 'https://git.kernel.org/stable/c/4ac15caa27ff842b068a54f1c6a8ff8b31f658e7'
  - url: 'https://git.kernel.org/stable/c/1ca52c0983c34fca506921791202ed5bdafd5306'
tags:
  - cve.org
epss: 0.00201
epssPercentile: 0.10065
ingestedAt: '2026-11-05T15:02:32.173Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

phy: qcom-qusb2: Fix NULL pointer dereference on early suspend

Enabling runtime PM before attaching the QPHY instance as driver data
can lead to a NULL pointer dereference in runtime PM callbacks that
expect valid driver data. There is a small window where the suspend
callback may run after PM runtime enabling and before runtime forbid.
This causes a sporadic crash during boot:

```
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1
[...]
CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT
Workqueue: pm pm_runtime_work
pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2]
lr : pm_generic_runtime_suspend+0x2c/0x44
[...]
```

Attach the QPHY instance as driver data before enabling runtime PM to
prevent NULL pointer dereference in runtime PM callbacks.

Reorder pm_runtime_enable() and pm_runtime_forbid() to prevent a
short window where an unnecessary runtime suspend can occur.

Use the devres-managed version to ensure PM runtime is symmetrically
disabled during driver removal for proper cleanup.

## Affected

- `Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c < f8a30ff99ae45d368737993961f7c334c76af5fa`
- `Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c < beba460a299150b5d8dcbe3474a8f4bdf0205180`
- `Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c < d50a9b7fd07296a1ab81c49ceba14cae3d31df86`
- `Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c < 4ac15caa27ff842b068a54f1c6a8ff8b31f658e7`
- `Linux >= 891a96f65ac3b12883ddbc6d1a9adf6e54dc903c < 1ca52c0983c34fca506921791202ed5bdafd5306`
- `Linux 4.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.