Executive brief
The Linux kernel's Qualcomm QMP USB PHY driver can crash when runtime power management attempts to suspend the PHY before it has been fully initialized. This affects systems using Qualcomm USB PHY controllers, potentially causing system instability or crashes during device power transitions.
Technical details
A null pointer dereference vulnerability exists in the phy-qcom-qmp-usb driver where the runtime suspend/resume callbacks dereference the qmp->phy pointer without checking if the PHY has been initialized. The vulnerability occurs in a race condition window between pm_runtime_enable() and pm_runtime_forbid(), or when users re-enable runtime PM via sysfs before initialization completes. The fix introduces a qmp->phy_initialized boolean flag to gate suspend/resume operations, preventing access to the uninitialized pointer. The vulnerability is resolved by checking this flag instead of relying on the phy->init_count member.
Affected products
- Linux Linux kernel prior to fix commit 142c5593379273264474f31d5956b1a0065cd576
Timeline
- 2026-09-17: disclosed
- 2026-08-07: patched