CVE-2026-68280

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68280", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.379Z", "datePublished": "2026-08-10T12:02:11.434Z", "dateUpdated": "2026-08-23T12:46:17.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:17.699Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()\n\nThe deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks\nfor both runtime PM and system sleep. This causes the DSI clocks to be\ndisabled twice: once during runtime suspend and again during system\nsuspend, resulting in a WARN message from the clock framework when\nattempting to disable already-disabled clocks.\n\n[ 84.384540] clk:231:5 already disabled\n[ 84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac\n...\n[ 84.579183] Call trace:\n[ 84.581624] clk_core_disable+0xa4/0xac\n[ 84.585457] clk_disable+0x30/0x4c\n[ 84.588857] cdns_dsi_suspend+0x20/0x58 [cdns_dsi]\n[ 84.593651] pm_generic_suspend+0x2c/0x44\n[ 84.597661] ti_sci_pd_suspend+0xbc/0x15c\n[ 84.601670] dpm_run_callback+0x8c/0x14c\n[ 84.605588] __device_suspend+0x1a0/0x56c\n[ 84.609594] dpm_suspend+0x17c/0x21c\n[ 84.613165] dpm_suspend_start+0xa0/0xa8\n[ 84.617083] suspend_devices_and_enter+0x12c/0x634\n[ 84.621872] pm_suspend+0x1fc/0x368\n\nTo address this issue, replace UNIVERSAL_DEV_PM_OPS() with\nRUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime\nPM, as the DRM framework manages system-wide power transitions through\nthe bridge enable() and disable() hooks."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c"], "versions": [{"version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "lessThan": "1014b279264c0fc9f56324608754e36d33b7b5ae", "status": "affected", "versionType": "git"}, {"version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "lessThan": "c18d46d9830c29677be5213a067daafe1ac80e43", "status": "affected", "versionType": "git"}, {"version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "lessThan": "347bc3a6a4d968c403d2292e5ad986294d919dfc", "status": "affected", "versionType": "git"}, {"version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "lessThan": "c0384d6872f4dc2701960048a0be1a12a8d2dc6e", "status": "affected", "versionType": "git"}, {"version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "lessThan": "1f9c6b74e79639179e90ad0c0fbeae26e31e044b", "status": "affected", "versionType": "git"}, {"version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "lessThan": "2d8b08844c0ecc6f2002fa68711e779aa18c8585", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1014b279264c0fc9f56324608754e36d33b7b5ae"}, {"url": "https://git.kernel.org/stable/c/c18d46d9830c29677be5213a067daafe1ac80e43"}, {"url": "https://git.kernel.org/stable/c/347bc3a6a4d968c403d2292e5ad986294d919dfc"}, {"url": "https://git.kernel.org/stable/c/c0384d6872f4dc2701960048a0be1a12a8d2dc6e"}, {"url": "https://git.kernel.org/stable/c/1f9c6b74e79639179e90ad0c0fbeae26e31e044b"}, {"url": "https://git.kernel.org/stable/c/2d8b08844c0ecc6f2002fa68711e779aa18c8585"}], "title": "drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1014b279264c0fc9f56324608754e36d33b7b5ae", "status": "affected", "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "versionType": "git"}, {"lessThan": "c18d46d9830c29677be5213a067daafe1ac80e43", "status": "affected", "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "versionType": "git"}, {"lessThan": "347bc3a6a4d968c403d2292e5ad986294d919dfc", "status": "affected", "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "versionType": "git"}, {"lessThan": "c0384d6872f4dc2701960048a0be1a12a8d2dc6e", "status": "affected", "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "versionType": "git"}, {"lessThan": "1f9c6b74e79639179e90ad0c0fbeae26e31e044b", "status": "affected", "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "versionType": "git"}, {"lessThan": "2d8b08844c0ecc6f2002fa68711e779aa18c8585", "status": "affected", "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()\n\nThe deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks\nfor both runtime PM and system sleep. This causes the DSI clocks to be\ndisabled twice: once during runtime suspend and again during system\nsuspend, resulting in a WARN message from the clock framework when\nattempting to disable already-disabled clocks.\n\n[ 84.384540] clk:231:5 already disabled\n[ 84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac\n...\n[ 84.579183] Call trace:\n[ 84.581624] clk_core_disable+0xa4/0xac\n[ 84.585457] clk_disable+0x30/0x4c\n[ 84.588857] cdns_dsi_suspend+0x20/0x58 [cdns_dsi]\n[ 84.593651] pm_generic_suspend+0x2c/0x44\n[ 84.597661] ti_sci_pd_suspend+0xbc/0x15c\n[ 84.601670] dpm_run_callback+0x8c/0x14c\n[ 84.605588] __device_suspend+0x1a0/0x56c\n[ 84.609594] dpm_suspend+0x17c/0x21c\n[ 84.613165] dpm_suspend_start+0xa0/0xa8\n[ 84.617083] suspend_devices_and_enter+0x12c/0x634\n[ 84.621872] pm_suspend+0x1fc/0x368\n\nTo address this issue, replace UNIVERSAL_DEV_PM_OPS() with\nRUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime\nPM, as the DRM framework manages system-wide power transitions through\nthe bridge enable() and disable() hooks."}], "id": "CVE-2026-68280", "lastModified": "2026-08-23T13:16:36.273", "metrics": {}, "published": "2026-08-10T13:20:17.170", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1014b279264c0fc9f56324608754e36d33b7b5ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f9c6b74e79639179e90ad0c0fbeae26e31e044b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2d8b08844c0ecc6f2002fa68711e779aa18c8585"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/347bc3a6a4d968c403d2292e5ad986294d919dfc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0384d6872f4dc2701960048a0be1a12a8d2dc6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c18d46d9830c29677be5213a067daafe1ac80e43"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()", "id": "2513436", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513436"}, "csaw": false, "cwe": "CWE-832", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()\nThe deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks\nfor both runtime PM and system sleep. This causes the DSI clocks to be\ndisabled twice: once during runtime suspend and again during system\nsuspend, resulting in a WARN message from the clock framework when\nattempting to disable already-disabled clocks.\n[ 84.384540] clk:231:5 already disabled\n[ 84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac\n...\n[ 84.579183] Call trace:\n[ 84.581624] clk_core_disable+0xa4/0xac\n[ 84.585457] clk_disable+0x30/0x4c\n[ 84.588857] cdns_dsi_suspend+0x20/0x58 [cdns_dsi]\n[ 84.593651] pm_generic_suspend+0x2c/0x44\n[ 84.597661] ti_sci_pd_suspend+0xbc/0x15c\n[ 84.601670] dpm_run_callback+0x8c/0x14c\n[ 84.605588] __device_suspend+0x1a0/0x56c\n[ 84.609594] dpm_suspend+0x17c/0x21c\n[ 84.613165] dpm_suspend_start+0xa0/0xa8\n[ 84.617083] suspend_devices_and_enter+0x12c/0x634\n[ 84.621872] pm_suspend+0x1fc/0x368\nTo address this issue, replace UNIVERSAL_DEV_PM_OPS() with\nRUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime\nPM, as the DRM framework manages system-wide power transitions through\nthe bridge enable() and disable() hooks.", "A flaw was found in the Linux kernel's `drm/bridge: cdns-dsi` component. This vulnerability arises from the incorrect use of a deprecated power management function, causing the system to attempt to disable DSI (Display Serial Interface) clocks twice during suspend operations. This redundant action triggers warning messages within the clock framework, which can lead to system instability or unexpected operational behavior."], "name": "CVE-2026-68280", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68280\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68280\nhttps://lore.kernel.org/linux-cve-announce/2026081026-CVE-2026-68280-ccf1@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e19233955d9e9a9ae202723b9a38ef38e755b5c0,c18d46d9830c29677be5213a067daafe1ac80e43)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e19233955d9e9a9ae202723b9a38ef38e755b5c0,347bc3a6a4d968c403d2292e5ad986294d919dfc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e19233955d9e9a9ae202723b9a38ef38e755b5c0,c0384d6872f4dc2701960048a0be1a12a8d2dc6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e19233955d9e9a9ae202723b9a38ef38e755b5c0,1f9c6b74e79639179e90ad0c0fbeae26e31e044b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e19233955d9e9a9ae202723b9a38ef38e755b5c0,2d8b08844c0ecc6f2002fa68711e779aa18c8585)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T15:30:05.873129+00:00", "updated": "2026-08-13T04:30:06.242498+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-832"]}