Cloudanix VulnDB

CVE-2026-93145

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug in power-domain handling for certain chips could stop drivers from loading correctly after the system tries to restart them, potentially causing boot or hardware problems.

Exploitation
Other
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

gdsc_unregister() omits pm_genpd_remove() calls on registered generic_pm_domain structures after tearing down subdomain links and the OF provider, leaving stale entries on the global gpd_list that cause subsequent gdsc_init() attempts to fail with -EEXIST during provider rebind cycles.

Why it matters to the business

Systems using affected Qualcomm clock drivers may experience repeated probe failures or boot instability after driver unload/reload events or deferred probe replays, increasing downtime risk on affected hardware fleets.

How an attack unfolds

An attacker with local access triggers repeated unbind/rebind cycles of the clk driver owning GDSCs (via module unload, OF overlay manipulation, or early-boot deferred probe replay); the dangling gpd_list entry then blocks re-registration on the next gdsc_init(), preventing domain initialization and causing dependent clock consumers to fail.

How to fix it

Apply the upstream fix that iterates the scs[] array, calls pm_genpd_remove() after subdomain teardown, and reorders OF provider removal to occur first; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the patched gdsc_unregister() implementation contains the pm_genpd_remove() loop and reordered of_genpd_del_provider() call; re-test module unload/reload and OF-overlay scenarios to verify no -EEXIST errors occur on re-registration.

Typical attack path

  1. Obtain local code execution or module control on the target
  2. Unload or force rebind of the Qualcomm clk driver owning GDSCs
  3. Trigger gdsc_unregister() without proper pm_genpd_remove()
  4. Initiate a subsequent gdsc_init() that collides on the stale gpd_list entry
  5. Observe -EEXIST failure and resulting clock domain initialization errors

How to detect it

Search kernel logs and dmesg for pm_genpd_init returning -EEXIST during clk or gdsc initialization after module unloads or early boot; inspect for repeated gdsc_register failures tied to Qualcomm GDSC providers.

What your security team should do

  • Prioritize patching kernel packages containing the gdsc changes on all Qualcomm-based devices
  • Monitor boot and driver load logs for repeated -EEXIST errors from pm_genpd_init
  • Limit unprivileged module loading where feasible until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() gdsc_unregister() removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pm_genpd_remove() on the individual generic_pm_domain structures registered by gdsc_init(): void gdsc_unregister(struct gdsc_desc *desc) { struct device *dev = desc->dev; size_t num = desc->num; gdsc_pm_subdomain_remove(desc, num); of_genpd_del_provider(dev->of_node); } That leaves dangling entries on the global gpd_list. After a provider unbind/rebind cycle (deferred-probe replay during early boot, real module unload of a clk driver that owns GDSCs, or an OF-overlay tear- down) the next gdsc_init() will end up trying to re-register a name that is still in the list and pm_genpd_init() returns -EEXIST. While we are here, flip the order so the consumer-facing OF provider entry is the first thing removed -- otherwise a fresh of_genpd_get_from_provider() call racing with the teardown could attach to a domain that is mid-removal. Iterate the scs[] array and pm_genpd_remove() each registered domain after the subdomain links are torn down. The regulators stay devm- managed (devm_regulator_get_optional() in gdsc_register()), so the release happens automatically when the underlying device is unbound; just the genpd accounting needs to be undone explicitly.

Affected packages

Ecosystem Package Introduced Fixed