Race condition in Linux kernel - CVE-2026-89946
Published: September 19, 2026
Vulnerability identifier: #VU151435
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89946
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause incorrect processing of amplifier fault release paths.
The vulnerability exists due to a race condition in the cs35l33 codec driver's runtime suspend and threaded IRQ handling when a threaded IRQ handler executes after runtime suspend has disabled live register access. A local user can cause a threaded IRQ handler to execute during runtime suspend to cause incorrect processing of amplifier fault release paths.
Critical fault IRQs must remain unmasked during runtime power management.
Affected software
Linux kernel
How to mitigate CVE-2026-89946
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/5b5311427e54d9c0d07178ee42df68ba44c2d5ca
- https://git.kernel.org/stable/c/614c2616ea677abfbed917a92bdc5141efff3536
- https://git.kernel.org/stable/c/6ae98918240585eb2ad32b097c4810f4e2dabe88
- https://git.kernel.org/stable/c/6e369bc46663b4bfce3d5f8b8ed08e71ecea13a2
- https://git.kernel.org/stable/c/84cf6acd01a1ec8f30276578a039216327af782e
- https://git.kernel.org/stable/c/a04722542c76ce861031384480825afded8cc4f4
- https://git.kernel.org/stable/c/d07799302721d381aef834fac8a11d196894eccb
- https://git.kernel.org/stable/c/e074c12c428c633e079154301207a6079a208583