CVE-2026-90406

What it actually does

Failure to validate the return value of pm_runtime_resume_and_get inside iris_core_deinit can leave runtime PM reference counts unbalanced or allow hardware power-off steps to be skipped during driver teardown.

Why it matters to the business

Systems using the affected Qualcomm iris media driver may experience occasional instability, resource leaks, or unexpected behavior during media subsystem shutdown, increasing operational risk on affected Linux deployments.

How an attack unfolds

An attacker with the ability to exercise the iris driver deinitialization path under conditions where runtime PM resume fails could trigger the unbalanced reference or skipped teardown, though no public exploitation is known.

How to fix it

Apply a kernel update that includes the corrected iris_core_deinit logic which properly checks the pm_runtime_resume_and_get return value and adjusts subsequent operations accordingly.

How to confirm the fix worked

Inspect the iris driver source for the presence of an explicit error check on pm_runtime_resume_and_get within iris_core_deinit and confirm that pm_runtime_put_sync is conditionally skipped on failure.

Typical attack path

1. Obtain local access or execute code that interacts with the iris media driver
2. Force or wait for iris_core_deinit to be invoked
3. Arrange for pm_runtime_resume_and_get to return an error
4. Observe resulting reference count imbalance or incomplete hardware shutdown

How to detect it

Examine kernel logs for iris driver messages around runtime PM resume failures or unbalanced reference warnings during media device deinitialization; correlate with process activity that exercises the iris core.

What your security team should do

• Prioritize kernel updates for any systems using the qcom iris media driver
• Review power-management related kernel logs after updates for residual iris errors
• Track upstream stable releases for backports of the fix