SB2026090443 - Improper Initialization in Linux kernel clk qcom driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-80746)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the display clock controller's root clock generator to stall while updating its configuration.

The vulnerability exists due to improper initialization in disp_cc_mdss_mdp_clk_src when probing the enabled Display Clock Controller on an Eliza EVK whose display is disabled. A local user can trigger controller initialization to cause the display clock controller's root clock generator to stall while updating its configuration.

The affected configuration references parent clocks from DSI PHYs.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2ef00630c5c0b7b2c08aba7643f47594952d357e
• https://git.kernel.org/stable/c/9114f72b91618b89a390a64d6c92765e14d555ae