CVE-2026-46292 Overview
CVE-2026-46292 is a Linux kernel vulnerability in the generic PM domain (genpd) subsystem within pmdomain/core. When a device attaches to a power management domain via genpd_dev_pm_attach_by_id(), genpd calls pm_runtime_enable() on the registered virtual device. The detach routine genpd_dev_pm_detach() omits the corresponding pm_runtime_disable() call. This leaves runtime PM enabled on detached virtual devices, contradicting the subsystem's design contract. In worst cases the imbalance triggers a NULL pointer dereference in genpd_runtime_suspend(), and in other cases it leaves stale votes for device performance states.
Critical Impact
A reference-count and lifecycle imbalance in genpd virtual device handling can lead to a NULL pointer dereference kernel crash and lingering performance-state votes.
Affected Products
- Linux kernel — pmdomain/core (generic PM domain) subsystem
- Drivers using genpd_dev_pm_attach_by_id() for multi-domain virtual device attachment
- Distribution kernels prior to backporting commits 26735df, 361518a, 51a7dd9, 707cb5d, and 8d44391
Discovery Timeline
- 2026-06-08 - CVE-2026-46292 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-46292
Vulnerability Analysis
The defect lives in the Linux kernel generic PM domain (genpd) core. The function genpd_dev_pm_attach_by_id() allocates a virtual device, attaches it to a specific PM domain, and invokes pm_runtime_enable() so callers avoid boilerplate. The teardown path genpd_dev_pm_detach() does not invoke pm_runtime_disable(). The runtime PM state on the virtual device therefore remains enabled after detach.
This imbalance breaks two invariants. First, subsequent runtime PM transitions can dereference state that has been torn down, producing a NULL pointer dereference inside genpd_runtime_suspend(). Second, any performance-state vote cast by the virtual device is not released, leaving the parent domain pinned at an elevated operating point. Both conditions cause stability and power-consumption regressions on systems using multi-domain devices, such as media, modem, and GPU subsystems on ARM SoCs.
Root Cause
The root cause is a missing cleanup call in the detach path [CWE-noinfo]. genpd_dev_pm_attach_by_id() enables runtime PM on the virtual device, but genpd_dev_pm_detach() releases the domain reference without disabling runtime PM. The fix adds the missing pm_runtime_disable() call so attach and detach are symmetric.
Attack Vector
Exploitation requires local interaction with kernel drivers that bind and unbind devices spanning multiple PM domains. An unprivileged trigger generally is not available. The realistic impact is a denial of service through a kernel NULL pointer dereference during runtime suspend, or degraded power management on affected platforms.
No verified public exploit code is available. See the upstream commits referenced below for the patch diffs that describe the corrected detach sequence.
Detection Methods for CVE-2026-46292
Indicators of Compromise
- Kernel oops or panic traces referencing genpd_runtime_suspend with a NULL pointer dereference signature.
- dmesg warnings about unbalanced runtime PM enable counts on virtual devices created by genpd.
- Performance domains reporting a sustained elevated state with no active consumer.
Detection Strategies
- Inventory running kernels against the fixed commits (26735df, 361518a, 51a7dd9, 707cb5d, 8d44391) using package version queries across managed Linux hosts.
- Parse /var/log/kern.log and journalctl -k for repeated genpd_runtime_suspend faults following driver unbind events.
- Track unexpected reboots correlated with module unload, suspend/resume cycles, or device hotplug operations on SoC platforms.
Monitoring Recommendations
- Forward kernel logs to a centralized analytics platform and alert on BUG: or Unable to handle kernel NULL pointer dereference strings that include genpd frames.
- Monitor pm_runtime_* sysfs counters on systems that frequently rebind multi-domain drivers.
- Track kernel crash dumps with kdump to confirm whether faults originate from the genpd detach path.
How to Mitigate CVE-2026-46292
Immediate Actions Required
- Apply the stable kernel update containing commits 26735df, 361518a, 51a7dd9, 707cb5d, and 8d44391 from git.kernel.org.
- Rebuild and redeploy any out-of-tree kernels or vendor BSPs that reuse the genpd core to include the fix.
- Audit drivers using genpd_dev_pm_attach_by_id() for additional attach/detach symmetry issues during the patch cycle.
Patch Information
The upstream fix adds a pm_runtime_disable() call inside genpd_dev_pm_detach() so that runtime PM enable and disable counts remain balanced for virtual devices. The fix has been backported across multiple stable trees. See the Linux Kernel Commit 26735df, Linux Kernel Commit 361518a, Linux Kernel Commit 51a7dd9, Linux Kernel Commit 707cb5d, and Linux Kernel Commit 8d44391 for the verified diffs.
Workarounds
- Avoid driver unbind cycles on devices attached through genpd_dev_pm_attach_by_id() until the kernel is updated.
- Disable runtime PM in affected drivers if vendor configurations permit, accepting the resulting power impact.
- Pin systems to a kernel build known to be free of the regression until patches are deployed.
# Verify the running kernel contains the genpd detach fix
uname -r
grep -E 'genpd_dev_pm_detach|pm_runtime_disable' /proc/kallsyms
# Apply distribution updates, then reboot
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
