CVE-2025-39722

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP

Since the CAAM on these SoCs is managed by another ARM core, called the

SECO (Security Controller) on iMX8QM and Secure Enclave on iMX8ULP, which

also reserves access to register page 0 suspend operations cannot touch

this page.

This is similar to when running OPTEE, where OPTEE will reserve page 0.

Track this situation using a new state variable no_page0, reflecting if

page 0 is reserved elsewhere, either by other management cores in SoC or

by OPTEE.

Replace the optee_en check in suspend/resume with the new check.

optee_en cannot go away as it's needed elsewhere to gate OPTEE specific

situations.

Fixes the following splat at suspend:

Internal error: synchronous external abort: 0000000096000010 [#1] SMP

Hardware name: Freescale i.MX8QXP ACU6C (DT)

pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : readl+0x0/0x18

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References