Vulnerability-Lookup

GHSA-7WVH-6FJM-X43J

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI

The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behavior if one domain disables the shared resource while the other is still active.

To fix the issue, introduce a shared MIPI PHY power domain to own the common resources and make DSI and CSI its subdomains. This ensures the shared bits are properly managed and not disabled while still in use.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72009"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:20:59Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use.",
  "id": "GHSA-7wvh-6fjm-x43j",
  "modified": "2026-08-17T06:33:04Z",
  "published": "2026-08-15T06:32:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72009"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-72009 (GCVE-0-2026-72009)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39

Title

pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI

Summary

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behavior if one domain disables the shared resource while the other is still active. To fix the issue, introduce a shared MIPI PHY power domain to own the common resources and make DSI and CSI its subdomains. This ensures the shared bits are properly managed and not disabled while still in use.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/4fd5b33faf092ef2d…
https://git.kernel.org/stable/c/4ba6d7166750d0b81…
https://git.kernel.org/stable/c/99611233f8cda8331…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 , < 4fd5b33faf092ef2d09f730a7d9e49f9e976ac67 (git) Affected: e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 , < 4ba6d7166750d0b810c6cfc0b1df7585f513b48c (git) Affected: e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 , < 99611233f8cda833169fa6487d5dacdf189e5cb0 (git)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pmdomain/imx/imx93-blk-ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4fd5b33faf092ef2d09f730a7d9e49f9e976ac67",
              "status": "affected",
              "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
              "versionType": "git"
            },
            {
              "lessThan": "4ba6d7166750d0b810c6cfc0b1df7585f513b48c",
              "status": "affected",
              "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
              "versionType": "git"
            },
            {
              "lessThan": "99611233f8cda833169fa6487d5dacdf189e5cb0",
              "status": "affected",
              "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pmdomain/imx/imx93-blk-ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access on an i.MX93 system to trigger MIPI DSI/CSI power-domain transitions via DRM display ioctls and V4L2 camera streaming on /dev/dri/* and /dev/video*; there is no network, Bluetooth, or physical USB attack path to this pmdomain driver.\nAC:L - On affected imx93 boards with both DSI and CSI enabled, an attacker can reliably reproduce the fault by starting a CSI capture (keeping the CSI genpd active) then suspending or closing the DSI path so imx93_blk_ctrl_power_off() clears shared PHY bit 12; no uncontrollable timing or rare layout is required.\nPR:L - Triggering the vulnerable power_off path needs only a local unprivileged application user able to open standard media device nodes (typical video/render group or embedded app account on automotive, kiosk, and industrial i.MX93 targets), not init-namespace root or capabilities unavailable via user namespaces.\nUI:N - No separate victim action is required when the attacker controls both display and camera interfaces on the same device; they can independently start CSI streaming and release DSI runtime PM to force premature shared PHY teardown.\nS:U - Impact is confined to kernel and on-chip media hardware on the same i.MX93 host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - Asserting reset and gating the shared MIPI PHY (BIT(12)) while CSI/DSI DMA is still active can leave media bus masters operating against powered-down hardware; on i.MX93 platforms without in-tree SMMU isolation this plausibly enables errant DMA reads exposing kernel or other process memory.\nI:H - The same premature PHY reset/clock gate during active capture or display transfers can cause misdirected media-master writes beyond intended buffers, corrupting arbitrary physical memory on affected embedded i.MX93 deployments where DMA is not IOMMU-contained.\nA:H - Disabling shared PHY resources while the sibling MIPI interface remains active causes camera/display failure, driver hangs, and potential kernel oops or panic from malfunctioning CSI/DSI hardware and interrupt storms on safety-critical embedded systems using concurrent display and camera."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:23.846Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c"
        },
        {
          "url": "https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"
        }
      ],
      "title": "pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72009",
    "datePublished": "2026-08-15T05:51:39.019Z",
    "dateReserved": "2026-08-09T03:40:39.899Z",
    "dateUpdated": "2026-08-17T05:39:23.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-7WVH-6FJM-X43J

CVE-2026-72009 (GCVE-0-2026-72009)

Tags

Sightings

Nomenclature