CVE-2026-93145: clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

clk: qcom: gdsc: tear down per-domain genpds in gdscunregister()

gdscunregister() removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pmgenpdremove() on the individual genericpmdomain structures registered by gdscinit():

void gdscunregister(struct gdscdesc desc) { struct device dev = desc->dev; sizet num = desc->num;

gdscpmsubdomainremove(desc, num); ofgenpddelprovider(dev->ofnode); }

That leaves dangling entries on the global gpdlist. After a provider unbind/rebind cycle (deferred-probe replay during early boot, real module unload of a clk driver that owns GDSCs, or an OF-overlay tear- down) the next gdscinit() will end up trying to re-register a name that is still in the list and pmgenpdinit() returns -EEXIST.

While we are here, flip the order so the consumer-facing OF provider entry is the first thing removed -- otherwise a fresh ofgenpdgetfromprovider() call racing with the teardown could attach to a domain that is mid-removal.

Iterate the scs[] array and pmgenpdremove() each registered domain after the subdomain links are torn down. The regulators stay devm- managed (devmregulatorgetoptional() in gdscregister()), so the release happens automatically when the underlying device is unbound; just the genpd accounting needs to be undone explicitly.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
Description

Frequently Asked Questions

1

Which systems are most likely to encounter this issue?

Systems using Qualcomm GDSC power-domain providers are exposed when a provider is unbound and later rebound. Examples described include deferred-probe replay during early boot, unloading a clock driver that owns GDSCs, and device-tree overlay teardown.

2

What symptom indicates that a previous provider teardown was incomplete?

After a provider unbind/rebind cycle, a subsequent gdsc_init() can fail because pm_genpd_init() returns -EEXIST. This occurs when generic power-domain entries from the previous instance remain on the global gpd_list.

3

Is there a teardown race affecting new power-domain consumers?

Yes. If the OF provider entry remains available while teardown is underway, a new of_genpd_get_from_provider() call could attach to a domain that is mid-removal. The resolved behavior removes the consumer-facing OF provider entry before removing subdomain links and individual generic power domains.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203