Executive brief
The CS35L34 audio codec driver in the Linux kernel has a race condition where interrupt handlers can execute after the device has been powered down and moved into cache-only mode during runtime PM suspension. An attacker or faulty condition could trigger spurious hardware operations, potentially causing system instability, incorrect device state, or unexpected power-down sequences when the codec is supposed to be inactive.
Technical details
The vulnerability is a race condition in the cs35l34_runtime_suspend() function where the threaded IRQ handler (cs35l34_irq_thread) can continue executing after the driver has switched into regcache_cache_only mode, asserted reset low, and powered off the device. The root cause is the absence of IRQ quiescing before entering low-power state. If the handler runs in-flight, it can read stale status registers and execute protected release sequences or power-down writes on inactive hardware. The fix uses disable_irq() before entering cache-only mode and re-enables it only after regcache_sync() restores live register access during runtime_resume(). A new irq_requested flag tracks whether the IRQ was successfully installed at probe time. Attack vector requires the system to be in runtime PM with unmasked critical fault IRQs, which can occur during normal operation of devices using this codec.
Affected products
- Linux Linux kernel 5.0 and later through at least 6.9
Timeline
- 2026-09-16: disclosed: CVE-2026-89945 published on NVD
- 2026-06-12: patched: Original fix commit 4105a4c0678b2808fc8046b60321b4f1cc7dae75 merged upstream