CVE-2026-90282: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
In the Linux kernel, the following vulnerability has been resolved:
phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
There is a small window where the runtime suspend callback may run after pmruntimeenable() and before pmruntimeforbid(). In this case, a crash occurs because runtime suspend/resume dereferences qmp->phy pointer, which is not yet initialized: if (!qmp->phy->initcount) {
This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized.
Similarly to other qcom phy drivers, introduce a qmp->phyinitialized variable that can be used to avoid relying on the possibly uninitialized phy pointer.
Event History
Frequently Asked Questions
Under what conditions can the crash occur?
The runtime suspend callback must run after pm_runtime_enable() but before pm_runtime_forbid(), while the qmp->phy pointer has not yet been initialized. It can also occur if runtime PM is re-enabled through the sysfs attribute before QMP PHY initialization completes.
What systems are realistically exposed to this issue?
Systems using the Linux kernel QCOM QMP USB legacy PHY driver are exposed when runtime PM can be invoked during the early initialization window. The described outcome is a kernel crash caused by a NULL pointer dereference in runtime suspend or resume handling.
Is this limited to an attacker-triggered condition?
The supplied information does not describe a remote or local attacker requirement. The condition can arise from runtime PM timing during driver initialization, and it may also be triggered by re-enabling runtime PM through sysfs before PHY initialization.