Executive brief
The Linux kernel's display subsystem contains a bug in how it manages power states for mobile display interfaces. When the display is powered down, the system fails to properly release a power vote, leaving the display clock running without adequate power backing. This can cause power inefficiency and potential system instability on affected mobile devices.
Technical details
The vulnerability exists in the DRM MSM DSI (Display Serial Interface) driver's clock disable function (dsi_link_clk_disable_6g). The issue is a resource management bug where dev_pm_opp_set_rate(0) was being called to drop a performance state vote, but this function does not actually park the clock, leaving it running without required power backing. The fix removes the explicit dev_pm_opp_set_rate(0) call, relying instead on the subsequent pm_runtime_put() call at each call site to properly rescind the power vote. This is a local kernel bug with no network attack vector; exploitation requires code execution on the affected system.
Affected products
- Linux Linux Kernel Affected versions prior to fix commit 06b7ba206561619bb34116f49e0ef26b867ce3aa
Timeline
- 2026-07-28: disclosed: Fix authored by Konrad Dybcio
- 2026-07-31: patched: Fix merged upstream
- 2026-09-14: advisory: Included in stable kernel release
- 2026-09-17: other: Published as CVE-2026-90362