Executive brief
A USB PHY driver for Sunplus SP7021 systems contained improper error handling that could leak system resources (clocks and reset controls) when initialization stages failed. This is a low-risk code quality issue affecting embedded and mobile devices that use this specific PHY controller.
Technical details
The vulnerability is a resource leak in the sp_uphy_init() error handling path within drivers/phy/sunplus/phy-sunplus-usb2.c. The function performs three sequential initialization stages (clock prepare/enable, reset deassertion, and disconnect voltage update), but the original error paths did not properly unwind resources on failure. Specifically: if reset_control_deassert() failed, the code would jump to err_reset (freeing both clock and reset) instead of err_clk (freeing only the clock), and if update_disc_vol() failed, it would return directly without freeing either resource. The fix ensures proper unwinding: return directly on clock failure, jump to err_clk on reset failure, and jump to err_reset on voltage update failure. This is a local driver initialization issue with no network attack surface.
Affected products
- Linux Linux kernel versions containing the Sunplus SP7021 USB2.0 PHY driver (introduced in or after the commit fixing 99d9ccd97385)
Timeline
- 2026-09-17: disclosed: CVE-2026-90287 published
- 2026-09-14: patched: Fix merged upstream by Sasha Levin
- 2026-08-03: other: Fix authored by Felix Gu