CVE-2026-31572: i2c: designware: amdisp: Fix resume-probe race condition issue
In the Linux kernel, the following vulnerability has been resolved:
i2c: designware: amdisp: Fix resume-probe race condition issue
Identified resume-probe race condition in kernel v7.0 with the commit 38fa29b01a6a ("i2c: designware: Combine the init functions"),but this issue existed from the beginning though not detected.
The amdisp i2c device requires ISP to be in power-on state for probe to succeed. To meet this requirement, this device is added to genpd to control ISP power using runtime PM. The pmruntimegetsync() called before i2cdwprobe() triggers PM resume, which powers on ISP and also invokes the amdisp i2c runtime resume before the probe completes resulting in this race condition and a NULL dereferencing issue in v7.0
Fix this race condition by using the genpd APIs directly during probe: - Call devpmgenpdresume() to Power ON ISP before probe - Call devpmgenpdsuspend() to Power OFF ISP after probe - Set the device to suspended state with pmruntimesetsuspended() - Enable runtime PM only after the device is fully initialized
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.21 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.11 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.11-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Configuration
During probe, call dev_pm_genpd_resume() to power on ISP before i2c_dw_probe(); after probe, call dev_pm_genpd_suspend() to power it off; call pm_runtime_set_suspended(); and enable runtime PM only after the device is fully initialized.
Linux kernel i2c designware amdisp probe and runtime PM genpd power sequencing and runtime PM initialization = Power on ISP before probe, power off ISP after probe, set suspended state, then enable runtime PM - Configuration
Add the amdisp i2c device to genpd so ISP power is controlled using runtime PM.
amdisp i2c device genpd membership = added to genpd
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31572?
CVE-2026-31572 has been classified with a severity level that indicates it could lead to a denial of service or system instability.
How do I fix CVE-2026-31572?
To fix CVE-2026-31572, update your Linux kernel to version 7.1 or later where the vulnerability is patched.
What does CVE-2026-31572 affect?
CVE-2026-31572 affects the i2c designware amdisp component of the Linux kernel up to version 7.0.
Can CVE-2026-31572 lead to data loss?
Yes, CVE-2026-31572 could potentially lead to data loss if the race condition is exploited during critical operations.
Is CVE-2026-31572 a remote exploit?
CVE-2026-31572 is generally not considered a remote exploit but can affect local interactions with the kernel.