Cloudanix VulnDB

CVE-2026-89721

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in how the system reads certain hardware settings can crash the computer when those settings are checked.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect max_register value (0x10000) in regmap for 64KB PHY block allows debugfs dumps to read past the ioremapped region (last valid offset 0xfffc), triggering page fault oops while regmap lock is held and deadlocking later PHY operations.

Why it matters to the business

Kernel crashes and deadlocks on systems using affected Rockchip hardware when PHY debug interfaces are accessed, causing service outages or forced reboots.

How an attack unfolds

An attacker or local user triggers a register dump through the regmap debugfs interface for the PHY driver; the out-of-bounds access faults on an unmapped page, the oops occurs under the held lock, and subsequent PHY operations deadlock.

How to fix it

Apply the upstream kernel commit correcting max_register to 0xfffc; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Confirm max_register is set to 0xfffc in the driver, then exercise the regmap debugfs interface and verify no oops or deadlock occurs.

Typical attack path

  1. Locate and access regmap debugfs entry for rockchip-samsung-dcphy
  2. Issue register dump or read operation
  3. Trigger read beyond ioremapped 64KB region
  4. Page fault occurs while regmap lock held
  5. Deadlock prevents further PHY driver use

How to detect it

Search kernel logs and dmesg for oops traces mentioning regmap, rockchip-samsung-dcphy, or page faults during register access; look for subsequent deadlock messages involving PHY operations.

What your security team should do

  • Prioritize kernel updates on systems exposing PHY debugfs
  • Restrict debugfs access to privileged users only
  • Monitor kernel logs for regmap-related oops events

The record

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range max_register The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. max_register names 0x10000, one register past the end of the mapping: dumping the registers through the regmap debugfs interface reads beyond the ioremapped region and oopses on the unmapped page. The oops fires with the regmap lock held, so later PHY operations deadlock.

Affected packages

Ecosystem Package Introduced Fixed