Skip to main content

Linux Kernel EUVDEUVD-2026-25465

| CVE-2026-31572 MEDIUM
Race Condition (CWE-362)
2026-04-24 Linux GHSA-3jx9-923c-c3x9
Information Disclosure Linux Race Condition
4.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Local-only access required on AMD ISP hardware, race condition makes timing complex (AC:H), low privilege sufficient; availability-only impact via kernel panic.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.7 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:07 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
4.7 (MEDIUM)
Patch released
Apr 27, 2026 - 20:33 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25465
CVE Published
Apr 24, 2026 - 14:35 nvd
MEDIUM 4.7

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

i2c: designware: amdisp: Fix resume-probe race condition issue

Identified resume-probe race condition in kernel v7.0 with the commit 38fa29b01a6a ("i2c: designware: Combine the init functions"),but this issue existed from the beginning though not detected.

The amdisp i2c device requires ISP to be in power-on state for probe to succeed. To meet this requirement, this device is added to genpd to control ISP power using runtime PM. The pm_runtime_get_sync() called before i2c_dw_probe() triggers PM resume, which powers on ISP and also invokes the amdisp i2c runtime resume before the probe completes resulting in this race condition and a NULL dereferencing issue in v7.0

Fix this race condition by using the genpd APIs directly during probe:

  • Call dev_pm_genpd_resume() to Power ON ISP before probe
  • Call dev_pm_genpd_suspend() to Power OFF ISP after probe
  • Set the device to suspended state with pm_runtime_set_suspended()
  • Enable runtime PM only after the device is fully initialized

AnalysisAI

NULL pointer dereference in the Linux kernel's i2c:designware:amdisp driver exposes AMD ISP-equipped systems to a local denial-of-service via a race condition between runtime PM resume and driver probe. The race exists because pm_runtime_get_sync() called before i2c_dw_probe() triggers PM resume, which powers on the ISP and simultaneously invokes the amdisp i2c runtime resume callback before probe initialization is complete - dereferencing an uninitialized pointer and causing a kernel panic. The flaw predates its detection but became reproducible in kernel v7.0 after commit 38fa29b01a6a reorganized init functions; no public exploit identified at time of analysis.

Technical ContextAI

The AMD ISP (Image Signal Processor) i2c controller is managed through the DesignWare i2c (i2c:designware) subsystem. Because the amdisp device requires the ISP to be powered on before probe succeeds, it is registered with the Linux Generic Power Domain (genpd) framework to gate ISP power through runtime PM. The bug arises in the probe sequence: pm_runtime_get_sync() is invoked prior to i2c_dw_probe(), which correctly powers on the ISP via genpd - but also prematurely fires the device's runtime resume callback. Since driver state (including pointers populated during probe) is not yet initialized, the resume handler dereferences a NULL pointer. Root cause class is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), a classic probe-vs-resume ordering race in kernel PM. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from commit d6263c468a761cd4c89887073614394ac48441e1.

RemediationAI

Update to a patched kernel release: Linux 6.18.21, Linux 6.19.11, or Linux 7.0, each of which includes the fix via the respective stable-tree commits (https://git.kernel.org/stable/c/83bcea9da91965484df64a6492b89e65d41ab31c, https://git.kernel.org/stable/c/e81f0341754c309e33babea2821eda8f98f0b44c, https://git.kernel.org/stable/c/e2f1ada8e089dd5a331bcd8b88125ae2af8d188f). The fix replaces the racy pm_runtime_get_sync() call with direct genpd API calls (dev_pm_genpd_resume() before probe, dev_pm_genpd_suspend() after probe), sets pm_runtime_set_suspended() to establish a known-clean state, and defers enabling runtime PM until after full initialization. If patching is not immediately possible, a compensating control is to prevent suspend/resume cycles on affected AMD ISP-equipped systems by disabling system suspend (e.g., masking suspend targets in systemd or setting /sys/power/state to none); note this trades power management functionality for stability. Blacklisting the amdisp i2c driver module is a more targeted workaround but will disable camera ISP functionality. Distribution-specific advisories from Red Hat and SUSE are expected given the tags.

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25465 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy