CVE-2026-31572

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31572", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.118Z", "datePublished": "2026-04-24T14:35:50.736Z", "dateUpdated": "2026-11-05T21:45:08.479Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:11:22.941Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: designware: amdisp: Fix resume-probe race condition issue\n\nIdentified resume-probe race condition in kernel v7.0 with the commit\n38fa29b01a6a (\"i2c: designware: Combine the init functions\"),but this\nissue existed from the beginning though not detected.\n\nThe amdisp i2c device requires ISP to be in power-on state for probe\nto succeed. To meet this requirement, this device is added to genpd\nto control ISP power using runtime PM. The pm_runtime_get_sync() called\nbefore i2c_dw_probe() triggers PM resume, which powers on ISP and also\ninvokes the amdisp i2c runtime resume before the probe completes resulting\nin this race condition and a NULL dereferencing issue in v7.0\n\nFix this race condition by using the genpd APIs directly during probe:\n - Call dev_pm_genpd_resume() to Power ON ISP before probe\n - Call dev_pm_genpd_suspend() to Power OFF ISP after probe\n - Set the device to suspended state with pm_runtime_set_suspended()\n - Enable runtime PM only after the device is fully initialized"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/busses/i2c-designware-amdisp.c"], "versions": [{"version": "d6263c468a761cd4c89887073614394ac48441e1", "lessThan": "83bcea9da91965484df64a6492b89e65d41ab31c", "status": "affected", "versionType": "git"}, {"version": "d6263c468a761cd4c89887073614394ac48441e1", "lessThan": "e81f0341754c309e33babea2821eda8f98f0b44c", "status": "affected", "versionType": "git"}, {"version": "d6263c468a761cd4c89887073614394ac48441e1", "lessThan": "e2f1ada8e089dd5a331bcd8b88125ae2af8d188f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/busses/i2c-designware-amdisp.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/83bcea9da91965484df64a6492b89e65d41ab31c"}, {"url": "https://git.kernel.org/stable/c/e81f0341754c309e33babea2821eda8f98f0b44c"}, {"url": "https://git.kernel.org/stable/c/e2f1ada8e089dd5a331bcd8b88125ae2af8d188f"}], "title": "i2c: designware: amdisp: Fix resume-probe race condition issue", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31572", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:22.654738Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:08.479Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31572", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:22.654738Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:39:25.379Z"}}], "cna": {"title": "i2c: designware: amdisp: Fix resume-probe race condition issue", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d6263c468a761cd4c89887073614394ac48441e1", "lessThan": "83bcea9da91965484df64a6492b89e65d41ab31c", "versionType": "git"}, {"status": "affected", "version": "d6263c468a761cd4c89887073614394ac48441e1", "lessThan": "e81f0341754c309e33babea2821eda8f98f0b44c", "versionType": "git"}, {"status": "affected", "version": "d6263c468a761cd4c89887073614394ac48441e1", "lessThan": "e2f1ada8e089dd5a331bcd8b88125ae2af8d188f", "versionType": "git"}], "programFiles": ["drivers/i2c/busses/i2c-designware-amdisp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/i2c/busses/i2c-designware-amdisp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/83bcea9da91965484df64a6492b89e65d41ab31c"}, {"url": "https://git.kernel.org/stable/c/e81f0341754c309e33babea2821eda8f98f0b44c"}, {"url": "https://git.kernel.org/stable/c/e2f1ada8e089dd5a331bcd8b88125ae2af8d188f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: designware: amdisp: Fix resume-probe race condition issue\n\nIdentified resume-probe race condition in kernel v7.0 with the commit\n38fa29b01a6a (\"i2c: designware: Combine the init functions\"),but this\nissue existed from the beginning though not detected.\n\nThe amdisp i2c device requires ISP to be in power-on state for probe\nto succeed. To meet this requirement, this device is added to genpd\nto control ISP power using runtime PM. The pm_runtime_get_sync() called\nbefore i2c_dw_probe() triggers PM resume, which powers on ISP and also\ninvokes the amdisp i2c runtime resume before the probe completes resulting\nin this race condition and a NULL dereferencing issue in v7.0\n\nFix this race condition by using the genpd APIs directly during probe:\n - Call dev_pm_genpd_resume() to Power ON ISP before probe\n - Call dev_pm_genpd_suspend() to Power OFF ISP after probe\n - Set the device to suspended state with pm_runtime_set_suspended()\n - Enable runtime PM only after the device is fully initialized"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:11:22.941Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31572", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:08.479Z", "dateReserved": "2026-03-09T15:48:24.118Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:35:50.736Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i2c/busses/i2c-designware-amdisp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "83bcea9da91965484df64a6492b89e65d41ab31c", "status": "affected", "version": "d6263c468a761cd4c89887073614394ac48441e1", "versionType": "git"}, {"lessThan": "e81f0341754c309e33babea2821eda8f98f0b44c", "status": "affected", "version": "d6263c468a761cd4c89887073614394ac48441e1", "versionType": "git"}, {"lessThan": "e2f1ada8e089dd5a331bcd8b88125ae2af8d188f", "status": "affected", "version": "d6263c468a761cd4c89887073614394ac48441e1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i2c/busses/i2c-designware-amdisp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABCE137D-81F5-4A69-BEC9-C222E10F0BAF", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*", "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: designware: amdisp: Fix resume-probe race condition issue\n\nIdentified resume-probe race condition in kernel v7.0 with the commit\n38fa29b01a6a (\"i2c: designware: Combine the init functions\"),but this\nissue existed from the beginning though not detected.\n\nThe amdisp i2c device requires ISP to be in power-on state for probe\nto succeed. To meet this requirement, this device is added to genpd\nto control ISP power using runtime PM. The pm_runtime_get_sync() called\nbefore i2c_dw_probe() triggers PM resume, which powers on ISP and also\ninvokes the amdisp i2c runtime resume before the probe completes resulting\nin this race condition and a NULL dereferencing issue in v7.0\n\nFix this race condition by using the genpd APIs directly during probe:\n - Call dev_pm_genpd_resume() to Power ON ISP before probe\n - Call dev_pm_genpd_suspend() to Power OFF ISP after probe\n - Set the device to suspended state with pm_runtime_set_suspended()\n - Enable runtime PM only after the device is fully initialized"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ni2c: designware: amdisp: Soluci\u00f3n al problema de condici\u00f3n de carrera de reanudaci\u00f3n-sonda\n\nSe identific\u00f3 una condici\u00f3n de carrera de reanudaci\u00f3n-sonda en el kernel v7.0 con el commit 38fa29b01a6a (\u2019i2c: designware: Combine the init functions\u2019), pero este problema exist\u00eda desde el principio aunque no fue detectado.\n\nEl dispositivo i2c amdisp requiere que el ISP est\u00e9 en estado de encendido para que la sonda tenga \u00e9xito. Para cumplir con este requisito, este dispositivo se a\u00f1ade a genpd para controlar la energ\u00eda del ISP utilizando PM en tiempo de ejecuci\u00f3n. La llamada a pm_runtime_get_sync() antes de i2c_dw_probe() activa la reanudaci\u00f3n de PM, lo que enciende el ISP y tambi\u00e9n invoca la reanudaci\u00f3n en tiempo de ejecuci\u00f3n del i2c amdisp antes de que la sonda se complete, resultando en esta condici\u00f3n de carrera y un problema de desreferenciaci\u00f3n de NULL en v7.0.\n\nSe corrige esta condici\u00f3n de carrera utilizando las APIs de genpd directamente durante la sonda:\n - Llamar a dev_pm_genpd_resume() para Encender el ISP antes de la sonda\n - Llamar a dev_pm_genpd_suspend() para Apagar el ISP despu\u00e9s de la sonda\n - Establecer el dispositivo en estado suspendido con pm_runtime_set_suspended()\n - Habilitar PM en tiempo de ejecuci\u00f3n solo despu\u00e9s de que el dispositivo est\u00e9 completamente inicializado"}], "id": "CVE-2026-31572", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31572", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:39:22.654738Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:31.757", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/83bcea9da91965484df64a6492b89e65d41ab31c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e2f1ada8e089dd5a331bcd8b88125ae2af8d188f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e81f0341754c309e33babea2821eda8f98f0b44c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: i2c: designware: amdisp: Fix resume-probe race condition issue", "id": "2461438", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461438"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's `i2c: designware: amdisp` component. A race condition exists between the device's probe and runtime Power Management (PM) resume operations. When `pm_runtime_get_sync()` is called before `i2c_dw_probe()`, it can prematurely trigger the `amdisp` i2c runtime resume before the device's probe process is complete. This timing issue can lead to a NULL dereferencing error, potentially causing system instability or a denial of service."], "name": "CVE-2026-31572", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31572\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31572\nhttps://lore.kernel.org/linux-cve-announce/2026042402-CVE-2026-31572-0eec@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6263c468a761cd4c89887073614394ac48441e1,83bcea9da91965484df64a6492b89e65d41ab31c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6263c468a761cd4c89887073614394ac48441e1,e81f0341754c309e33babea2821eda8f98f0b44c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6263c468a761cd4c89887073614394ac48441e1,e2f1ada8e089dd5a331bcd8b88125ae2af8d188f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T14:09:37.535157+00:00", "value": {"mitigation_remediation": ["Apply a Linux kernel version that includes commit\u202f38fa29b01a which fixes the race condition", "Reboot the system so that the patched kernel takes effect", "If the device is not required, disable the amdisp i2c device via device tree or modprobe options to avoid triggering the probe routine"], "summary": {"action": "Immediate patch", "impact": "NULL dereference leading to kernel crash"}, "threat_synthesis": {"affected_systems": "All Linux kernel releases up through the initial stable release of version\u202f7.0, including kernel\u00a06.16 and the 7.0\u2011rc releases\u00a01\u20137, are affected. The issue existed from the outset of the driver; only the commit that reordered the PM calls in v7.0 applied the fix. Systems running any kernel that does not contain this commit are vulnerable.", "description_and_impact": "The vulnerability is a race condition in the I\u00b2C designware driver for the amdisp device. It occurs when the runtime power\u2011management routine triggers an ISP power\u2011on during probe before the driver\u2019s initialization completes, resulting in a NULL dereference that can crash the kernel and cause a denial of service. The flaw corresponds to CWE\u2011362 (Race Condition) and CWE\u2011367 (Improper Locking).", "risk_and_exploitability": "The CVSS score of 4.7 places the flaw in the medium\u2011severity range, and the EPSS score of <\u202f1\u202f% indicates a very low observed exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local, as it requires the kernel\u2019s probe routine to run during boot or when the device is enabled. An attacker with local or kernel privilege could trigger a kernel crash and cause a denial of service. The patch eliminates the race by calling the generic power\u2011domain API directly during probe, suspending the device afterward, and enabling runtime PM only after initialization."}}}}, "created": "2026-04-27T19:00:15.750541+00:00", "updated": "2026-04-28T14:15:34.915461+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}