Cloudanix VulnDB

CVE-2026-90282

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux power handling for certain hardware chips can crash the whole system if power saving activates before setup finishes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in Qualcomm QMP USB legacy PHY driver allows runtime suspend callback to run before PHY pointer initialization after pm_runtime_enable but before pm_runtime_forbid, causing NULL dereference on qmp->phy->init_count access; same window exists via sysfs re-enable of runtime PM.

Why it matters to the business

Unexpected kernel crashes or instability during power management on systems using the affected driver, resulting in downtime and potential data loss for workloads relying on USB PHY hardware.

How an attack unfolds

An attacker with local access manipulates runtime power management states or sysfs attributes to trigger suspend in the initialization window, dereferencing an uninitialized pointer and crashing the kernel.

How to fix it

Apply the upstream fix that introduces a phy_initialized flag to guard dereferences in the runtime suspend/resume paths; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Inspect kernel source for presence of qmp->phy_initialized checks before phy pointer access in qmp_usb_legacy runtime callbacks; verify runtime PM sequencing prevents early suspend.

Typical attack path

  1. Obtain local access to the system
  2. Use sysfs or power management interfaces to enable runtime PM before PHY initialization completes
  3. Force or wait for runtime suspend callback execution
  4. Trigger NULL dereference leading to kernel panic

How to detect it

Search kernel logs and dmesg for NULL pointer dereference oops in qmp phy runtime suspend paths or phy init_count access; correlate with sysfs runtime_pm writes near driver probe time.

  • qmp->phy->init_count
  • NULL dereference in qmp_usb_legacy runtime suspend
  • phy_initialized

What your security team should do

  • Prioritize kernel update on all systems using qcom qmp-usb-legacy PHY within 30 days
  • Audit power management configurations and sysfs exposure for runtime PM controls
  • Monitor for kernel oops reports involving PHY initialization

The record

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pm_runtime_enable() and before pm_runtime_forbid(). In this case, a crash occurs because runtime suspend/resume dereferences qmp->phy pointer, which is not yet initialized: `if (!qmp->phy->init_count) {` This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized. Similarly to other qcom phy drivers, introduce a qmp->phy_initialized variable that can be used to avoid relying on the possibly uninitialized phy pointer.

Affected packages

Ecosystem Package Introduced Fixed