Executive brief
A Qualcomm USB PHY driver in the Linux kernel contained a race condition where runtime power management callbacks could execute before the PHY device was fully initialized, causing a system crash. This affects devices using Qualcomm's SNPS Femto v2 USB PHY controller. The issue could be triggered during early system power transitions on affected mobile devices or embedded systems.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) in the Qualcomm SNPS Femto v2 PHY driver probe function. The root cause is improper timing of runtime PM initialization: runtime PM was enabled before the PHY device structure was fully constructed, allowing suspend callbacks to dereference uninitialized pointers. The fix uses pm_runtime_get_noresume() to take a usage reference before enabling runtime PM, preventing suspend from running during initialization, then releases the reference once phy_create() completes. The patch also switches to devm_pm_runtime_enable() for proper resource cleanup. No authentication or user interaction is required; the issue triggers automatically during driver initialization.
Affected products
- Linux Linux kernel multiple versions before the fix commit c271a6926ea7d3c9566b033d63fd4e8c488dc860
Timeline
- 2026-09-17: disclosed
- 2026-07-22: patched: Upstream commit c271a6926ea7d3c9566b033d63fd4e8c488dc860 by Loic Poulain