CVE-2026-90280

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL-dereference issue exists in the qmp-usb component of the qcom phy driver. A crash can occur during early runtime suspend if the runtime suspend callback executes after pm runtime enable() but before pm runtime forbid(), or if a user re-enables runtime-pm via the sysfs attribute before the qmp phy is initialized. This happens because the system attempts to dereference the qmp->phy pointer while it is still uninitialized, specifically within the check if (!qmp->phy->init count) {.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.