Cloudanix VulnDB

CVE-2026-99034

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A power-management mistake in Linux storage hardware handling can cause the system to crash when a device is removed while in low-power mode.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The sdhci-sprd driver enables runtime PM in probe but fails to resume the device, disable runtime PM, and drop the PM reference before disabling clocks in the normal remove path, allowing clock operations on an already-suspended device.

Why it matters to the business

Linux systems using this driver may experience kernel instability, crashes, or undefined behavior during driver unload or device removal on affected hardware, increasing operational risk for embedded and mobile deployments.

How an attack unfolds

An attacker with local access triggers runtime suspend of the device then initiates driver removal or module unload, causing the remove path to disable clocks without first resuming, resulting in a race that can crash the kernel.

How to fix it

Apply the upstream fix that resumes the device, disables runtime PM, and drops the temporary reference before disabling clocks; update to a patched Linux kernel version.

How to confirm the fix worked

Inspect the sdhci_sprd_remove function to confirm it calls pm_runtime_resume, pm_runtime_disable, and pm_runtime_put before any clock operations, and test remove after suspend.

Typical attack path

  1. Trigger runtime suspend via power management on the SDHCI device
  2. Initiate driver removal or rmmod of the sdhci-sprd module
  3. Execute clock disable operations while the device remains suspended

How to detect it

Search kernel logs and dmesg for oops, warnings, or stack traces referencing sdhci_sprd_remove, runtime PM, or clock disable failures during module unload or device removal.

What your security team should do

  • Apply kernel updates containing the runtime PM cleanup fix with highest priority on systems using sdhci-sprd
  • Audit module load/unload paths in production kernels for similar PM handling patterns
  • Monitor kernel logs for oops or warnings during mmc device removal

The record

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks, but the normal remove path directly disables clocks that are also managed by the runtime PM callbacks. If the device is runtime suspended, those clocks may already be disabled. Resume the device before removal, disable runtime PM and drop the temporary runtime PM reference before disabling the clocks. This issue was found by manual code inspection.

Affected packages

Ecosystem Package Introduced Fixed