CVE-2026-97512: spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM
The runtime PM functions had incomplete error handling that could leave the system in an inconsistent state. If any operation failed midway through suspend or resume, some resources would be left in the wrong state while others were already changed, leading to potential clock/power imbalances.
Reorder the suspend/resume sequences to avoid brownout risk by ensuring the performance state is set appropriately before clocks are enabled and clocks are disabled before dropping the performance state.
Fix by adding proper error checking for all operations and using goto-based cleanup to ensure all successfully acquired resources are properly released on any error.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel spi-qcom-qspi runtime PM implementation, add error checking for all operations and use goto-based cleanup so that all successfully acquired resources are released on any suspend or resume error; set the performance state before enabling clocks and disable clocks before dropping the performance state.
Event History
Frequently Asked Questions
What systems are most likely to be exposed to this issue?
Systems running the Linux kernel with the Qualcomm QSPI SPI driver and using runtime power management are the relevant population. The issue is triggered when suspend or resume operations encounter an error partway through their sequence.
What is the practical impact of a failed runtime PM transition?
A partial suspend or resume can leave clocks, power-related resources, and the performance state out of sync. This can create clock or power imbalances and carries a brownout risk.
What should be done if a runtime PM operation fails?
Use a kernel version containing the fix, which adds error checks and cleanup for resources acquired before a failure. The corrected ordering sets the performance state before enabling clocks and disables clocks before dropping the performance state.