GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72009 (GCVE-0-2026-72009)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
Summary
In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behavior if one domain disables the shared resource while the other is still active. To fix the issue, introduce a shared MIPI PHY power domain to own the common resources and make DSI and CSI its subdomains. This ensures the shared bits are properly managed and not disabled while still in use.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 , < 4fd5b33faf092ef2d09f730a7d9e49f9e976ac67 (git)
Affected: e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 , < 4ba6d7166750d0b810c6cfc0b1df7585f513b48c (git)
Affected: e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 , < 99611233f8cda833169fa6487d5dacdf189e5cb0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pmdomain/imx/imx93-blk-ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4fd5b33faf092ef2d09f730a7d9e49f9e976ac67",
              "status": "affected",
              "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
              "versionType": "git"
            },
            {
              "lessThan": "4ba6d7166750d0b810c6cfc0b1df7585f513b48c",
              "status": "affected",
              "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
              "versionType": "git"
            },
            {
              "lessThan": "99611233f8cda833169fa6487d5dacdf189e5cb0",
              "status": "affected",
              "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pmdomain/imx/imx93-blk-ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access on an i.MX93 system to trigger MIPI DSI/CSI power-domain transitions via DRM display ioctls and V4L2 camera streaming on /dev/dri/* and /dev/video*; there is no network, Bluetooth, or physical USB attack path to this pmdomain driver.\nAC:L - On affected imx93 boards with both DSI and CSI enabled, an attacker can reliably reproduce the fault by starting a CSI capture (keeping the CSI genpd active) then suspending or closing the DSI path so imx93_blk_ctrl_power_off() clears shared PHY bit 12; no uncontrollable timing or rare layout is required.\nPR:L - Triggering the vulnerable power_off path needs only a local unprivileged application user able to open standard media device nodes (typical video/render group or embedded app account on automotive, kiosk, and industrial i.MX93 targets), not init-namespace root or capabilities unavailable via user namespaces.\nUI:N - No separate victim action is required when the attacker controls both display and camera interfaces on the same device; they can independently start CSI streaming and release DSI runtime PM to force premature shared PHY teardown.\nS:U - Impact is confined to kernel and on-chip media hardware on the same i.MX93 host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - Asserting reset and gating the shared MIPI PHY (BIT(12)) while CSI/DSI DMA is still active can leave media bus masters operating against powered-down hardware; on i.MX93 platforms without in-tree SMMU isolation this plausibly enables errant DMA reads exposing kernel or other process memory.\nI:H - The same premature PHY reset/clock gate during active capture or display transfers can cause misdirected media-master writes beyond intended buffers, corrupting arbitrary physical memory on affected embedded i.MX93 deployments where DMA is not IOMMU-contained.\nA:H - Disabling shared PHY resources while the sibling MIPI interface remains active causes camera/display failure, driver hangs, and potential kernel oops or panic from malfunctioning CSI/DSI hardware and interrupt storms on safety-critical embedded systems using concurrent display and camera."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:23.846Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c"
        },
        {
          "url": "https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"
        }
      ],
      "title": "pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72009",
    "datePublished": "2026-08-15T05:51:39.019Z",
    "dateReserved": "2026-08-09T03:40:39.899Z",
    "dateUpdated": "2026-08-17T05:39:23.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72009",
      "date": "2026-09-04",
      "epss": "0.00162",
      "percentile": "0.05638"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:00:12.000Z",
      "cve": "CVE-2026-72009",
      "id": "msrc_CVE-2026-72009",
      "initial_release_date": "2026-08-23T15:00:12.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72009.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72009\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:20:59.570\",\"lastModified\":\"2026-08-17T06:17:58.333\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\\n\\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\\ncan lead to incorrect behavior if one domain disables the shared resource\\nwhile the other is still active.\\n\\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\\ncommon resources and make DSI and CSI its subdomains. This ensures the\\nshared bits are properly managed and not disabled while still in use.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/pmdomain/imx/imx93-blk-ctrl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e9aa77d413c903ba4cf7da3fe0b419cae5b97a81\",\"lessThan\":\"4fd5b33faf092ef2d09f730a7d9e49f9e976ac67\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9aa77d413c903ba4cf7da3fe0b419cae5b97a81\",\"lessThan\":\"4ba6d7166750d0b810c6cfc0b1df7585f513b48c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9aa77d413c903ba4cf7da3fe0b419cae5b97a81\",\"lessThan\":\"99611233f8cda833169fa6487d5dacdf189e5cb0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/pmdomain/imx/imx93-blk-ctrl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T05:25:09+00:00",
      "cve": "CVE-2026-72009",
      "id": "CVE-2026-72009",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72009.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.