In the Linux kernel, the following vulnerability has been resolved:

phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend

There is a small window where the runtime suspend callback may run
after pm_runtime_enable() and before pm_runtime_forbid(). In this
case, a crash occurs because runtime suspend/resume dereferences
qmp->phy pointer, which is not yet initialized:
`if (!qmp->phy->init_count) {`

This can also happen if user re-enables runtime-pm via the sysfs
attribute before qmp phy is initialized.

Similarly to other qcom phy drivers, introduce a qmp->phy_initialized
variable that can be used to avoid relying on the possibly uninitialized
phy pointer.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
e464a3180a43b6596bd267f9f274e1793bfb8150 affected < 602059c5128a78857ca92bd22791ab640185e381
e464a3180a43b6596bd267f9f274e1793bfb8150 affected < 29449ce1f5958e36df80318878016e3ecac26b40
e464a3180a43b6596bd267f9f274e1793bfb8150 affected < 52ad86ea5f98d29a7a29d9ba12e24276c6e30acd
e464a3180a43b6596bd267f9f274e1793bfb8150 affected < 0f9789d1b63e7d9f868ac9c29564339a4c03ceb5
e464a3180a43b6596bd267f9f274e1793bfb8150 affected < 8e3687f7e18fe84372e86875709d56c37e7525a8
Linux Linux affected
Version Status Constraints
6.6 affected —
0 unaffected < 6.6
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0f9789d1b63e7d9f868ac9c29564339a4c03ceb5 cve-icon cve-icon
https://git.kernel.org/stable/c/29449ce1f5958e36df80318878016e3ecac26b40 cve-icon cve-icon
https://git.kernel.org/stable/c/52ad86ea5f98d29a7a29d9ba12e24276c6e30acd cve-icon cve-icon
https://git.kernel.org/stable/c/602059c5128a78857ca92bd22791ab640185e381 cve-icon cve-icon
https://git.kernel.org/stable/c/8e3687f7e18fe84372e86875709d56c37e7525a8 cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pm_runtime_enable() and before pm_runtime_forbid(). In this case, a crash occurs because runtime suspend/resume dereferences qmp->phy pointer, which is not yet initialized: `if (!qmp->phy->init_count) {` This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized. Similarly to other qcom phy drivers, introduce a qmp->phy_initialized variable that can be used to avoid relying on the possibly uninitialized phy pointer.
Title phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:08:12.681Z

Reserved: 2026-09-11T19:38:34.797Z

Link: CVE-2026-90282

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:24.950

Modified: 2026-09-17T17:17:24.950

Link: CVE-2026-90282

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.