CVE-2026-31572None▾ Sunlit

i2c: designware: amdisp: Fix resume-probe race condition issue

In the Linux kernel, the following vulnerability has been resolved: i2c: designware: amdisp: Fix resume-probe race condition issue Identified resume-probe race condition in kernel v7.0 with the commit 38fa29b01a6a ("i2c: designware: Co…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Apr 24, 2026

Updated

Nov 5, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.09% · p0

Platforms

—

Source

CVEORG

Vector

—

CISA SSVC

decided 2026-11-05

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Nov 5.

0.09% → 0.09%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 195 days

Apr 24, 2026Published
Disclosed via CVEORG
Nov 5, 2026Record revised
Last analysed / modified upstream
Nov 5, 2026EPSS first tracked
0.09%

Linux #cve.org

Affected

Linux >= d6263c468a761cd4c89887073614394ac48441e1 < 83bcea9da91965484df64a6492b89e65d41ab31c
Linux >= d6263c468a761cd4c89887073614394ac48441e1 < e81f0341754c309e33babea2821eda8f98f0b44c
Linux >= d6263c468a761cd4c89887073614394ac48441e1 < e2f1ada8e089dd5a331bcd8b88125ae2af8d188f
Linux 6.16

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

i2c: designware: amdisp: Fix resume-probe race condition issue

Identified resume-probe race condition in kernel v7.0 with the commit 38fa29b01a6a ("i2c: designware: Combine the init functions"),but this issue existed from the beginning though not detected.

The amdisp i2c device requires ISP to be in power-on state for probe to succeed. To meet this requirement, this device is added to genpd to control ISP power using runtime PM. The pm_runtime_get_sync() called before i2c_dw_probe() triggers PM resume, which powers on ISP and also invokes the amdisp i2c runtime resume before the probe completes resulting in this race condition and a NULL dereferencing issue in v7.0

Fix this race condition by using the genpd APIs directly during probe:

Call dev_pm_genpd_resume() to Power ON ISP before probe
Call dev_pm_genpd_suspend() to Power OFF ISP after probe
Set the device to suspended state with pm_runtime_set_suspended()
Enable runtime PM only after the device is fully initialized

Affected

Linux >= d6263c468a761cd4c89887073614394ac48441e1 < 83bcea9da91965484df64a6492b89e65d41ab31c
Linux >= d6263c468a761cd4c89887073614394ac48441e1 < e81f0341754c309e33babea2821eda8f98f0b44c
Linux >= d6263c468a761cd4c89887073614394ac48441e1 < e2f1ada8e089dd5a331bcd8b88125ae2af8d188f
Linux 6.16

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

i2c: designware: amdisp: Fix resume-probe race condition issue

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

i2c: designware: amdisp: Fix resume-probe race condition issue

Identified resume-probe race condition in kernel v7.0 with the commit 38fa29b01a6a ("i2c: designware: Combine the init functions"),but this issue existed from the beginning though not detected.

Fix this race condition by using the genpd APIs directly during probe:

Call dev_pm_genpd_resume() to Power ON ISP before probe

Call dev_pm_genpd_suspend() to Power OFF ISP after probe

Set the device to suspended state with pm_runtime_set_suspended()

Enable runtime PM only after the device is fully initialized