What’s Vulnerable › Vulnerabilities

CVE-2026-90406: media: qcom: iris: handle runtime PM resume failure in core deinit

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pm_runtime_resume_and_get() in iris_core_deinit(). If runtime PM resume fails, skip hardware power-off operations but still perform software teardown and state transition. Also skip the corresponding pm_runtime_put_sync() call to avoid unbalanced runtime PM references.

Affected products

• Linux kernel: 6.15 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/75d79879ec3cbfd288144b0ae4c3e3fa7700c5fc
• https://git.kernel.org/stable/c/cb83cfff8dff5d546fadce15596e01b1504b632a
• https://git.kernel.org/stable/c/e7768f3dae9f2c6e5b80e9c02429550ea39f2be6

Get alerted when CVE-2026-90406 or the next vulnerability affects your stack