Medium 5.5Published Feb 14, 2026

CVE-2025-71200mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode

Updated under an hour ago (Oct 27, 2026, 3:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode When operating in HS200 or HS400 timing modes, reducing the clock frequency below 52MHz will lead to link broken as the Rockchip DWC MSHC controller requires maintaining a minimum clock of 52MHz in these modes. Add a check to prevent illegal clock reduction through debugfs: root@debian:/# echo 50000000 > /sys/kernel/debug/mmc0/clock root@debian:/# [ 30.090146] mmc0: running CQE recovery mmc0: cqhci: Failed to halt mmc0: cqhci: spurious TCN for tag 0 WARNING: drivers/mmc/host/cqhci-core.c:797 at cqhci_irq+0x254/0x818, CPU#1: kworker/1:0H/24 Modules linked in: CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Not tainted 6.19.0-rc1-00001-g09db0998649d-dirty #204 PREEMPT Hardware name: Rockchip RK3588 EVB1 V10 Board (DT) Workqueue: kblockd blk_mq_run_work_fn pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : cqhci_irq+0x254/0x818 lr : cqhci_irq+0x254/0x818 ...

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4 before 59b8a1ca6df4db2ca250e9eeab74e2b0068d69e9; from c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4 before f2677d6e2bbc5ba2030825522d2afd0542b038a3; from c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4 before de0ad7156036a50982bcb75a080e4af284502be2; from c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4 before 36be050f21dea7a3a76dff5a031da6274e8ee468; from c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4 before 3009738a855cf938bbfc9078bec725031ae623a4	CNA record
linux linux_kernel linux:linux_kernel	from 6.0 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 6.19; 6.19; 6.19; 6.19; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/59b8a1ca6df4db2ca250e9eeab74e2b0068d69e9	patch
https://git.kernel.org/stable/c/f2677d6e2bbc5ba2030825522d2afd0542b038a3	patch
https://git.kernel.org/stable/c/de0ad7156036a50982bcb75a080e4af284502be2	patch
https://git.kernel.org/stable/c/36be050f21dea7a3a76dff5a031da6274e8ee468	patch
https://git.kernel.org/stable/c/3009738a855cf938bbfc9078bec725031ae623a4	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.