Cloudanix VulnDB

CVE-2026-90281

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in certain hardware power-saving code could cause some computers to crash when the system tries to reduce power usage.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in PHY initialization allows runtime suspend callback to dereference an uninitialized hsphy instance, causing NULL pointer dereference before phy_create completes.

Why it matters to the business

Affected Linux systems may experience kernel crashes or instability during power management events, leading to unplanned downtime on devices using the Qualcomm snps-femto-v2 PHY driver.

How an attack unfolds

An attacker with local access triggers runtime PM suspend events in the window after runtime PM is enabled on the parent but before the PHY instance is ready, causing the callback to hit the NULL dereference.

How to fix it

Apply the upstream fix that calls pm_runtime_get_noresume before enabling runtime PM, releases the reference after phy creation, and uses the devres-managed variant for symmetric cleanup on driver removal.

How to confirm the fix worked

Confirm the patch is present by inspecting the snps-femto-v2 driver source for the pm_runtime_get_noresume call before phy_create and the corresponding put on removal.

Typical attack path

  1. Obtain local execution context on the target system
  2. Induce runtime power management suspend on the USB PHY device
  3. Time the suspend to occur in the initialization race window

How to detect it

Search kernel logs and crash dumps for NULL pointer dereference stack traces that reference runtime suspend callbacks in the qcom snps-femto-v2 PHY driver.

  • NULL dereference in phy qcom snps-femto-v2 runtime suspend
  • hsphy instance not ready during pm_runtime

What your security team should do

  • Update to a kernel containing the resolved PHY initialization sequence
  • Monitor kernel logs for oops or NULL dereference entries involving hsphy or snps-femto-v2
  • Test runtime suspend/resume cycles on representative hardware after patching

The record

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. However, the runtime PM callbacks dereference the hsphy instance, which is not yet ready, leaving a window where a suspend callback may trigger a NULL pointer dereference. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created, so that no runtime suspend can run before the PHY is ready. This also prevents a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup.

Affected packages

Ecosystem Package Introduced Fixed