From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CAD113F788D for ; Thu, 24 Sep 2026 16:25:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790267130; cv=none; b=IcPcmMVJ1sVwN6j+DOu4qvNNwmKtuT81nJVhJ90WvSiWBZ+v5ZuWOmGzgNPneU7UEMp3qqPI/+BZR7dS2xjV0ggWn6H3jpQHY8rQN+e6rKuwn8XA+WVQwg21nY6prYuMBbZz9QUg3vhrK0neOZqL1Uvs4+BsycvQjlVHcd1iHnk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790267130; c=relaxed/simple; bh=zQpLD7OCz3d/dJdQWVz84KSD17/VGBzwAg1wiwSvAmI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=quuxqzLSYslHynkX7BG2dYsvOSAfdGJZZQ/9mLGAvvLqlUPvcuv3xf0BagVN5jLbJZ9JWLdRWcjbvxV3sNK0OA7XWvWOvyEKZWe89n0vTFq/zT9+K5ZyKbkwa5sXUwtkG9QFIIDL5PY1oPuOdFzcxRZotuAcddjR2crCKdCffIU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0XM/O3ED; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0XM/O3ED" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCB171F000FF; Thu, 24 Sep 2026 16:25:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790267129; bh=U6tNW8CoTcR2u2vKjUiiqsGkECsQ7GmQqyxo111ZXC8=; h=From:To:Cc:Subject:Date:Reply-To; b=0XM/O3EDpCMW/5pm/q8/s/D1ne7d/xX9DMpve28Hc6ybRQQukXVqmu5tSiNyHtg/9 GagqDgDNvk6RcR8fNr/+kmS+vU0trbk/HoNMcsPvdcX2Co3amrCjB4u2DPvdU6KI4e cOb0TUoh6liNyZ6OxV4bxAVxwYhZAh6L30zem71k= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-97512: spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM Date: Thu, 24 Sep 2026 18:04:37 +0200 Message-ID: <2026092443-CVE-2026-97512-366d@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2435; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=6JupjyoC5V1g/bmf1WrCU6HkEQ56I4tTnsD/om/Z5CQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlbPRefO3Y6jU1rj21h+9HtHjK2FWGXlyZNfK3GuX3/J Y6g+7+vd8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEUk0ZFqy3vtKq/pe79fsB thL3uhmVcuJB4gzztKP9giyS+UqMtrRMfOAVfXa5ThkvAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM The runtime PM functions had incomplete error handling that could leave the system in an inconsistent state. If any operation failed midway through suspend or resume, some resources would be left in the wrong state while others were already changed, leading to potential clock/power imbalances. Reorder the suspend/resume sequences to avoid brownout risk by ensuring the performance state is set appropriately before clocks are enabled and clocks are disabled before dropping the performance state. Fix by adding proper error checking for all operations and using goto-based cleanup to ensure all successfully acquired resources are properly released on any error. The Linux kernel CVE team has assigned CVE-2026-97512 to this issue. Affected and fixed versions =========================== Fixed in 6.12.111 with commit 62dd3b8d3a92eb4e080b2ae491c2a5341654c1ee Fixed in 6.18.53 with commit bb18a346271f87889bd64a3861c9a656a3509ea6 Fixed in 7.2 with commit d283d5d4d9f6d081ddb65e371be26fffeb611c42 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-97512 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/spi/spi-qcom-qspi.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/62dd3b8d3a92eb4e080b2ae491c2a5341654c1ee https://git.kernel.org/stable/c/bb18a346271f87889bd64a3861c9a656a3509ea6 https://git.kernel.org/stable/c/d283d5d4d9f6d081ddb65e371be26fffeb611c42