Executive brief
The Linux kernel's Qualcomm Iris video codec driver contains a race condition in its power-off routine. When the VPU (video processing unit) powers down, an interrupt handler may still execute after the hardware has been disabled, leading to potential system instability or crashes from accessing powered-down hardware registers.
Technical details
The vulnerability is a race condition in the iris_vpu_power_off() function in the Qualcomm Iris media driver. The code uses disable_irq_nosync() to disable a threaded IRQ handler, but this function returns immediately without waiting for any already-queued IRQ handler to complete. As a result, the threaded IRQ handler may execute and attempt to access hardware registers after the VPU has been powered down, causing invalid memory access or system crashes. The fix replaces disable_irq_nosync() with disable_irq(), which synchronously waits for in-flight handlers to complete before returning. This is a kernel-mode issue requiring the affected system to run vulnerable kernel code; no authentication or network access is required to trigger it.
Affected products
- Linux Linux kernel all versions with media/qcom/iris driver prior to patch
Timeline
- 2026-09-16: disclosed
- 2026-07-30: patched: upstream patch merged