Cloudanix VulnDB

CVE-2026-90280

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in certain Qualcomm USB hardware support code can crash the whole computer if power-saving features turn on too early during startup.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition allows runtime suspend callback to execute before qmp->phy is initialized, dereferencing a NULL pointer in the init_count check and causing a kernel crash.

Why it matters to the business

Systems using Qualcomm USB PHY drivers may experience unexpected kernel panics and reboots when runtime power management is enabled before full PHY initialization, leading to service disruption and potential data loss on affected hardware.

How an attack unfolds

An attacker with local access triggers the window by enabling runtime PM via sysfs or by timing device suspend/resume events immediately after pm_runtime_enable but before pm_runtime_forbid, causing the uninitialized phy pointer dereference.

How to fix it

Apply the upstream kernel patch that adds a qmp->phy_initialized boolean guard before any dereference of the phy pointer; rebuild and deploy the fixed kernel on affected devices.

How to confirm the fix worked

Inspect the qmp-usb driver source for the phy_initialized variable and its use in the suspend/resume paths; verify the fix is present in the running kernel via source or binary comparison.

Typical attack path

  1. Obtain local unprivileged access on a Linux system using the qcom qmp-usb PHY driver
  2. Enable or manipulate runtime power management through sysfs attributes before PHY initialization completes
  3. Trigger a runtime suspend event that enters the vulnerable callback path
  4. Cause NULL dereference crash in the init_count check

How to detect it

Search kernel logs and crash dumps for oops traces containing qmp-usb, phy pointer dereference, or runtime suspend paths; correlate with sysfs runtime_pm writes around device initialization time.

What your security team should do

  • Prioritize kernel updates containing the phy_initialized guard on all Qualcomm USB PHY systems
  • Disable runtime PM via sysfs or kernel parameters until patches are applied if the hardware is in scope
  • Monitor kernel logs for oops messages referencing qmp phy dereferences

The record

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pm_runtime_enable() and before pm_runtime_forbid(). In this case, a crash occurs because runtime suspend/resume dereferences qmp->phy pointer, which is not yet initialized: `if (!qmp->phy->init_count) {` This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized. Similarly to other qcom phy drivers, introduce a qmp->phy_initialized variable that can be used to avoid relying on the possibly uninitialized phy pointer.

Affected packages

Ecosystem Package Introduced Fixed