CVE-2026-93184: ASoC: fsl_audmix: rework runtime PM handling in probe
In the Linux kernel, the following vulnerability has been resolved:
ASoC: fslaudmix: rework runtime PM handling in probe
After pmruntimeenable() the AUDMIX block is powered off and stays suspended until the first runtime resume. Register writes issued between probe() and the first resume (e.g. from DAPM or ALSA control paths) target unpowered hardware and cause a system hang.
Fix this by calling pmruntimeresumeandget() immediately after pmruntimeenable() to power the hardware up and enable its clocks. Release the reference afterwards with pmruntimeput() to allow the runtime PM framework to suspend the device and switch the regmap to cache-only mode when idle.
When CONFIGPM is disabled or runtime PM is not enabled, pmruntime calls are stubs that do not power up the hardware. Handle this case explicitly by calling fslaudmixruntimeresume() directly so the hardware is always initialised and its clocks are enabled, ensuring register accesses succeed regardless of PM configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In fsl_audmix probe(), immediately call pm_runtime_resume_and_get() right after pm_runtime_enable() so the AUDMIX block powers on and does not remain powered off.
Linux kernel driver: fsl_audmix runtime PM handling sequence in probe() = Call pm_runtime_resume_and_get() immediately after pm_runtime_enable() - Configuration
When CONFIG_PM is disabled or runtime PM is not enabled (so pm_runtime_* calls are stubs/cache-only), explicitly invoke fsl_audmix_runtime_resume() so hardware is initialised and its clocks are enabled, ensuring register accesses succeed from DAPM/ALSA control paths.
Linux kernel driver: fsl_audmix runtime resume path under CONFIG_PM disabled or runtime PM not enabled = Call fsl_audmix_runtime_resume() explicitly - Configuration
After performing register writes while holding the runtime PM reference (via pm_runtime_resume_and_get()), release the reference afterwards with pm_runtime_put() to allow the runtime PM framework to suspend the device and switch regmap back to suspended.
Linux kernel driver: fsl_audmix runtime PM reference handling = Release reference with pm_runtime_put() after register writes
Event History
Frequently Asked Questions
Which systems are exposed to the hang condition?
Systems using the Linux kernel fsl_audmix ASoC driver are exposed when register writes occur after probe completes but before the device's first runtime resume. This can occur through DAPM or ALSA control paths while the AUDMIX hardware remains powered off.
Does disabling power-management support avoid the issue?
No. With CONFIG_PM disabled or runtime PM not enabled, pm_runtime calls are stubs and do not power up the hardware, so explicit runtime-resume initialization is needed to enable the hardware and its clocks.
What change addresses the issue?
The fix powers the device up immediately after runtime PM is enabled using pm_runtime_resume_and_get(), then releases the reference with pm_runtime_put(). It also directly calls fsl_audmix_runtime_resume() when runtime PM is unavailable so register accesses target initialized hardware.