CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: bcm: bcm2835-power: Increase ASB control timeout
The bcm2835asbcontrol() function uses a tight polling loop to wait for the ASB bridge to acknowledge a request. During intensive workloads, this handshake intermittently fails for V3D's master ASB on BCM2711, resulting in "Failed to disable ASB master for v3d" errors during runtime PM suspend. As a consequence, the failed power-off leaves V3D in a broken state, leading to bus faults or system hangs on later accesses.
As the timeout is insufficient in some scenarios, increase the polling timeout from 1us to 5us, which is still negligible in the context of a power domain transition. Also, replace the open-coded ktimegetns()/ cpurelax() polling loop with readlpolltimeoutatomic().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Replace the open-coded ktime_get_ns()/cpu_relax() polling loop in bcm2835_asb_control() with readl_poll_timeout_atomic(), and increase the polling timeout from 1us to 5us.
Linux kernel bcm2835-power ASB control polling timeout and mechanism = 5us; readl_poll_timeout_atomic()
Event History
Frequently Asked Questions
Which systems are most likely to experience this issue?
The issue is associated with the V3D master ASB on BCM2711 systems. It occurs intermittently during intensive workloads when runtime power management attempts to suspend V3D.
How can I tell whether a system has encountered the problem?
Look for the kernel error "Failed to disable ASB master for v3d" during runtime PM suspend. Subsequent V3D accesses may then produce bus faults or cause system hangs.
What change resolves the failure?
The resolved kernel change increases the ASB control polling timeout from 1 microsecond to 5 microseconds and uses readl_poll_timeout_atomic() for the polling loop. Applying a Linux kernel update containing this change addresses the insufficient timeout.