Executive brief
The Linux kernel's Qualcomm USB PHY driver can crash when the system attempts to suspend power on the USB interface before the driver has fully initialized the PHY hardware pointer. This occurs in a narrow timing window during system startup or when users re-enable runtime power management. A system crash in this driver can interrupt device connectivity and require a reboot, affecting any system relying on USB peripherals.
Technical details
A NULL pointer dereference vulnerability exists in the Qualcomm QMP USB legacy PHY driver (drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c). The vulnerability occurs when the runtime suspend callback dereferences the qmp->phy pointer before it has been initialized, attempting to check qmp->phy->init_count. This can happen in a race condition between pm_runtime_enable() and pm_runtime_forbid(), or if a user re-enables runtime PM via sysfs before the PHY is initialized. The fix introduces a boolean flag qmp->phy_initialized to track initialization state, avoiding the unsafe dereference. No preconditions beyond normal system operation are required to trigger this.
Affected products
- Linux Linux kernel Multiple versions (affected component in phy-qcom-qmp-usb-legacy.c)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-09-14: patched: Fix committed to stable kernel tree