CVE-2026-90281 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
A race condition in the Qualcomm SNPS FEMTO v2 PHY driver allows a NULL pointer dereference during early runtime suspend, causing a kernel crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90281?
CVE-2026-90281 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
Runtime PM must be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. However, the runtime PM callbacks dereference the hsphy instance, which is not yet ready, leaving a window where a suspend callback may trigger a NULL pointer dereference.
Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created, so that no runtime suspend can run before the PHY is ready. This also prevents a short window where an unnecessary runtime suspend can occur.
Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup.
Which versions are affected by CVE-2026-90281?
How do I fix CVE-2026-90281?
Apply the vendor's patch.
Is CVE-2026-90281 being exploited?
There is no known exploitation of CVE-2026-90281 in the wild and no public exploit code.
Sources
Also known as AZL-102404, BELL-CVE-2026-90281, DEBIAN-CVE-2026-90281, GHSA-26w5-r3wx-93h7, UBUNTU-CVE-2026-90281.