CVE-2026-31572: Linux Kernel Race Condition Vulnerability

CVE-2026-31572 Overview

CVE-2026-31572 is a race condition vulnerability in the Linux kernel's i2c-designware-amdisp driver. The flaw exists in the resume-probe sequence where pm_runtime_get_sync() triggers a power management resume callback before the probe function completes. This causes the amdisp i2c runtime resume handler to execute against an uninitialized device, leading to a NULL pointer dereference. The issue surfaced with commit 38fa29b01a6a ("i2c: designware: Combine the init functions") in kernel v7.0 but existed latently since the driver's introduction. Successful exploitation requires local access and causes a denial of service through kernel crash.

Critical Impact
Local attackers with low privileges can trigger a NULL pointer dereference in the kernel through the i2c designware amdisp driver, causing system crashes and denial of service.

Affected Products

Linux Kernel 6.16
Linux Kernel 7.0-rc1 through 7.0-rc7
Systems using the i2c-designware-amdisp driver with AMD ISP hardware

Discovery Timeline

2026-04-24 - CVE-2026-31572 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31572

Vulnerability Analysis

The vulnerability resides in the Synopsys DesignWare i2c controller driver's AMD Image Signal Processor (ISP) variant. The amdisp i2c device requires the ISP to be powered on before its probe routine can succeed. To satisfy this dependency, the device is registered with the generic power domain (genpd) framework, which controls ISP power through runtime power management (PM).

During device initialization, the driver calls pm_runtime_get_sync() before i2c_dw_probe(). This call triggers a PM resume that both powers on the ISP and invokes the amdisp i2c runtime resume callback. Because probe has not yet completed, internal driver structures remain uninitialized when the runtime resume handler executes. The handler then dereferences NULL pointers, causing a kernel oops. This is classified as [CWE-362] Concurrent Execution using Shared Resource with Improper Synchronization.

Root Cause

The root cause is improper ordering between runtime PM enablement and device initialization. The probe function enables runtime PM and requests a synchronous resume while the device state is still being constructed. The resume callback assumes a fully initialized device context, which has not yet been established. Commit 38fa29b01a6a exposed the latent defect by consolidating init functions, but the underlying logic flaw predates that change.

Attack Vector

Exploitation requires local access to a system running an affected kernel version with the amdisp i2c driver loaded against AMD ISP hardware. The race condition triggers during device probe and resume cycles. An attacker capable of inducing module load or system suspend/resume sequences can deterministically trigger the NULL dereference, resulting in kernel crash and denial of service. The vulnerability does not provide a path to code execution or information disclosure.

The fix replaces the runtime PM calls in probe with direct genpd APIs: dev_pm_genpd_resume() powers on the ISP before probe, dev_pm_genpd_suspend() powers it off after probe, pm_runtime_set_suspended() synchronizes the runtime state, and runtime PM is enabled only after full device initialization.

Detection Methods for CVE-2026-31572

Indicators of Compromise

Kernel oops or panic messages referencing i2c_designware_amdisp or amd_isp in dmesg output
NULL pointer dereference stack traces involving runtime PM resume callbacks during boot or resume from suspend
Repeated probe failures for the amdisp i2c device on AMD platforms with ISP hardware

Detection Strategies

Inventory running kernel versions across Linux endpoints and flag systems on kernel 6.16 or 7.0-rc1 through 7.0-rc7 that load the i2c-designware-amdisp module
Monitor /var/log/kern.log and journalctl -k for NULL dereference signatures correlated with i2c designware probe events
Correlate system crash dumps with the affected driver stack frames to identify exploitation attempts or unintended triggers

Monitoring Recommendations

Aggregate kernel crash telemetry centrally and alert on patterns matching the affected driver subsystem
Track kernel package versions through configuration management and surface deviations from patched baselines
Review suspend/resume cycle stability on AMD laptops and embedded platforms using ISP hardware

How to Mitigate CVE-2026-31572

Immediate Actions Required

Update Linux kernels to a stable release containing the upstream fix commits referenced in the kernel.org advisories
Identify AMD platforms with ISP hardware running affected kernels and prioritize patching to prevent denial of service through unintended crashes
For systems unable to update immediately, evaluate unloading or blacklisting the i2c-designware-amdisp module if the ISP functionality is not required

Patch Information

The fix is committed upstream in the Linux kernel stable tree. Patched commits are available at Kernel Git Commit 83bcea9, Kernel Git Commit e2f1ada, and Kernel Git Commit e81f034. The patch restructures the probe sequence to use direct genpd APIs and defers runtime PM enablement until after device initialization completes.

Workarounds

Blacklist the i2c-designware-amdisp module on systems that do not require AMD ISP functionality by adding blacklist i2c_designware_amdisp to /etc/modprobe.d/
Avoid suspend/resume cycles on affected systems until the kernel is updated to a patched release
Restrict local user access on multi-user systems to reduce the population of accounts capable of triggering the race condition

bash

# Blacklist the affected module until kernel is patched
echo "blacklist i2c_designware_amdisp" | sudo tee /etc/modprobe.d/cve-2026-31572.conf
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep i2c_designware_amdisp