CVE-2026-93145 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
gdsc_unregister() removes the OF provider entry and tears down the parent/subdomain wiring, but never calls pm_genpd_remove() on the individual generic_pm_domain structures registered by gdsc_init():
void gdsc_unregister(struct gdsc_desc *desc) {
struct device *dev = desc->dev; size_t num = desc->num;
gdsc_pm_subdomain_remove(desc, num); of_genpd_del_provider(dev->of_node); }
That leaves dangling entries on the global gpd_list. After a provider unbind/rebind cycle (deferred-probe replay during early boot, real module unload of a clk driver that owns GDSCs, or an OF-overlay tear- down) the next gdsc_init() will end up trying to re-register a name that is still in the list and pm_genpd_init() returns -EEXIST.
While we are here, flip the order so the consumer-facing OF provider entry is the first thing removed -- otherwise a fresh of_genpd_get_from_provider() call racing with the teardown could attach to a domain that is mid-removal.
Iterate the scs[] array and pm_genpd_remove() each registered domain
after the subdomain links are torn down. The regulators stay devm- managed (devm_regulator_get_optional() in gdsc_register()), so the release happens automatically when the underlying device is unbound; just the genpd accounting needs to be undone explicitly.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The identified vulnerability resides within the Linux kernel's clock management subsystem, specifically affecting Qualcomm Generic Domain Supply Controller drivers. This issue manifests as a resource leak and state inconsistency resulting from improper cleanup procedures during driver unbinding or system reconfiguration events. The core technical flaw lies in the gdsc_unregister function, which is responsible for dismantling power domain structures associated with specific hardware blocks. While this function correctly removes the Open Firmware provider entry and tears down parent-subdomain wiring relationships, it fails to invoke pm_genpd_remove on the individual generic_pm_domain structures that were previously initialized via gdsc_init. This omission leaves dangling entries in the global generic power domain list maintained by the kernel's power management subsystem. Consequently, the accounting data for these domains remains registered even though the functional components have been logically detached from the system hierarchy.
The operational impact of this defect becomes apparent during provider unbind and rebind cycles, which can occur due to deferred-probe replay mechanisms during early boot sequences, explicit module unload operations of clock drivers that own GDSCs, or when Open Firmware overlays are torn down in dynamic systems. In these scenarios, the subsequent invocation of gdsc_init attempts to register a new power domain using a name identifier that is still present in the global list due to the incomplete teardown described above. The pm_genpd_init function detects this duplicate registration and returns an -EEXIST error code, preventing the successful initialization of the hardware block. This leads to driver probe failures, potential system instability during hotplug events, or inability to re-initialize clock domains after a reset sequence, effectively rendering the associated hardware non-functional until a full reboot is performed.
To address this vulnerability, the remediation strategy involves modifying the gdsc_unregister routine to explicitly iterate through the scs array and call pm_genpd_remove for each registered domain structure. This ensures that all kernel accounting data is properly cleaned up from the global list before the driver context is destroyed. Additionally, the order of operations within the unregister function has been adjusted so that the consumer-facing Open Firmware provider entry is removed first. This ordering change prevents race conditions where a fresh request to retrieve a power domain via of_genpd_get_from_provider might attempt to attach to a domain structure that is currently in the midst of being torn down, thereby avoiding potential use-after-free scenarios or access to invalid memory states. It is important to note that regulator resources managed through devm_regulator_get_optional are handled automatically by the device resource management framework upon unbind and do not require explicit intervention in this specific cleanup path; only the generic power domain accounting requires manual reversal.
From a security and standards perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective lifetime, as well as CWE-362, involving concurrent execution race conditions that can lead to resource corruption or inconsistent states. The failure to properly clean up kernel data structures creates opportunities for state confusion attacks where an attacker might exploit the lingering references to manipulate system behavior during subsequent initialization phases. Furthermore, this issue relates to ATT&CK technique T1070, specifically indicators of removal, as improper cleanup can leave artifacts that complicate forensic analysis or allow persistence mechanisms to evade detection by maintaining stale kernel object references. The fix ensures compliance with robust resource management practices mandated by modern operating system security models, ensuring that all allocated resources are released in the reverse order of their acquisition and that global state is kept consistent during lifecycle transitions.