CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: core: Fix detach procedure for virtual devices in genpd
If a device is attached to a PM domain through genpddevpmattachbyid(), genpd calls pmruntimeenable() for the corresponding virtual device that it registers. While this avoids boilerplate code in drivers, there is no corresponding call to pmruntimedisable() in genpddevpmdetach().
This means these virtual devices are typically detached from its genpd, while runtime PM remains enabled for them, which is not how things are designed to work. In worst cases it may lead to critical errors, like a NULL pointer dereference bug in genpdruntimesuspend(), which was recently reported. For another case, we may end up keeping an unnecessary vote for a performance state for the device.
To fix these problems, let's add this missing call to pmruntimedisable() in genpddevpmdetach().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Add the missing pm_runtime_disable() call to the genpd_dev_pm_detach() detach procedure for virtual devices so runtime PM is disabled after detachment (the bug described is caused by runtime PM remaining enabled).
Linux kernel pmdomain core (genpd) pm_runtime_disable() must be called during genpd_dev_pm_detach() for virtual devices = call pm_runtime_disable() in genpd_dev_pm_detach()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46292?
CVE-2026-46292 has a risk score of 34, indicating a moderate level of severity.
How do I fix CVE-2026-46292?
To fix CVE-2026-46292, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-46292?
CVE-2026-46292 affects the Linux kernel where virtual devices use the PM domain through genpd.
What is the nature of the vulnerability in CVE-2026-46292?
CVE-2026-46292 is classified as a Null Pointer Dereference vulnerability in the Linux kernel.
When was CVE-2026-46292 published?
CVE-2026-46292 was published on June 8, 2026.