Linux Kernel CVE-2026-72009

Exploitation requires: (1) local access with at least low-privilege credentials on the target system; (2) the target hardware must be an NXP i.MX93 SoC; (3) both MIPI DSI and MIPI CSI power domains must be enabled and active in the device tree - a non-default configuration on many deployments that may have only one of the two interfaces wired; (4) the kernel must be running an affected version of the imx93-blk-ctrl driver predating the fix commits. Systems with only one of DSI or CSI enabled are not vulnerable to the shared-resource conflict. Remote exploitation is not possible - the attack vector is strictly local (AV:L per CVSS). Authentication requirements per CVSS: PR:L, meaning a low-privilege local account is sufficient; unauthenticated or anonymous network exploitation is not applicable.

The NVD-assigned CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) represents a worst-case kernel exploitation scenario and warrants scrutiny. The attack vector is strictly local (AV:L), requiring an attacker already present on the target system with low-privilege access. The hardware scope is narrow - only systems running i.MX93 SoCs (embedded/industrial boards, not general-purpose servers) are affected. EPSS is 0.20% at the 10th percentile, indicating the security community broadly does not expect widespread exploitation. The vulnerability is not in CISA KEV, and no public exploit code has been identified. The C:H/I:H/A:H impact ratings are plausible in a kernel-level scenario (memory corruption, crash, or privilege escalation), but the realistic path to full exploitation of a power-domain timing bug is considerably more complex than a straightforward memory corruption. The AC:L rating in the vendor vector may overstate exploitability - triggering the race between domain power transitions likely requires deliberate orchestration, suggesting AC:H is more accurate for targeted exploitation. Real-world risk is low to medium for most organizations, elevated only for embedded product vendors shipping i.MX93-based hardware running affected kernel versions.

A local attacker with low-privilege shell access on an i.MX93-based embedded device (e.g., an industrial HMI or IoT gateway with both a camera and display) rapidly and repeatedly toggles the power state of the MIPI DSI domain while the CSI domain is actively streaming, causing the shared PHY clock or reset bits to be cleared mid-operation. This results in a kernel oops, use-after-free condition, or memory corruption in the PHY/clock subsystem, which the attacker may then leverage to escalate privileges. No public proof-of-concept exploit code has been identified at time of analysis.