Executive brief
The Linux kernel's cs35l33 audio codec driver has a race condition where its interrupt handler can run after the driver has suspended and disabled register access. If a hardware fault interrupt fires during this window, it may cause unintended audio amplifier state changes. This could result in incorrect audio behavior or device instability on systems using this codec.
Technical details
The vulnerability is a race condition in the cs35l33 codec driver's power management. The cs35l33_runtime_suspend() function switches to cache-only mode and powers down the device without first disabling its threaded IRQ handler. If the handler executes after cache_only is enabled, it attempts to read volatile registers that are no longer accessible, but can still execute fault release paths (AMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, OTW_RLS) with stale or invalid data. The fix uses disable_irq() before entering cache_only/power-off and re-enables it in runtime_resume() after regcache_sync() restores register access. A boolean flag tracks whether the IRQ was successfully installed, since probe only warns on request failure.
Affected products
- Linux Linux kernel Linux kernel (affects codecs/cs35l33 driver; patch backported to stable branches)
Timeline
- 2026-09-16: disclosed: CVE-2026-89946 published on NVD
- 2026-09-14: patched: Patch committed to stable Linux kernel by Greg Kroah-Hartman
- 2026-06-12: other: Original fix authored by Runyu Xiao