AZL-102852
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102852.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-102852
- Upstream
- Published
- 2026-09-17T17:17:24Z
- Modified
- 2026-09-18T14:16:35Z
- Summary
- CVE-2026-90282 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
There is a small window where the runtime suspend callback may run after pm_runtime_enable() and before pm_runtime_forbid(). In this case, a crash occurs because runtime suspend/resume dereferences qmp->phy pointer, which is not yet initialized:
if (!qmp->phy->init_count) {This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized.
Similarly to other qcom phy drivers, introduce a qmp->phy_initialized variable that can be used to avoid relying on the possibly uninitialized phy pointer.
- References