CVE-2026-68280: Linux Kernel Privilege Escalation Flaw

CVE-2026-68280 Overview

CVE-2026-68280 affects the Linux kernel's drm/bridge/cdns-dsi Display Serial Interface (DSI) bridge driver. The driver used the deprecated UNIVERSAL_DEV_PM_OPS() macro, which registers the same callback for both runtime power management (PM) and system sleep. As a result, DSI clocks were disabled twice during system suspend: once by the runtime PM path and again by the system suspend path. The second disable triggered a WARN from the clock framework because the clock was already disabled. The fix replaces UNIVERSAL_DEV_PM_OPS() with RUNTIME_PM_OPS() so the bridge driver only manages runtime PM and defers system-wide transitions to the DRM framework.

Critical Impact
The defect causes a kernel warning and clock state inconsistency during suspend on systems using the Cadence DSI bridge, without evidence of remote exploitability.

Affected Products

Linux kernel builds including the drm/bridge/cdns-dsi driver using UNIVERSAL_DEV_PM_OPS()
Stable branches referenced by the upstream fix commits
Platforms integrating the Cadence MIPI DSI bridge (for example, TI SoCs using ti_sci_pd_suspend)

Discovery Timeline

2026-08-10 - CVE-2026-68280 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68280

Vulnerability Analysis

The cdns-dsi bridge driver registered its power management callbacks through the deprecated UNIVERSAL_DEV_PM_OPS() macro. This macro binds the same suspend and resume handlers to runtime PM operations and to system sleep operations. During a system suspend transition, the kernel first invokes runtime suspend, which calls cdns_dsi_suspend() and disables the DSI clocks. The system sleep path then invokes cdns_dsi_suspend() a second time, attempting to disable clocks that are already gated.

The clock framework detects the invalid state in clk_core_disable() at drivers/clk/clk.c:1181 and emits a WARN. The reported call trace shows the double-disable path traversing pm_generic_suspend, ti_sci_pd_suspend, dpm_run_callback, and __device_suspend. Bridge and panel drivers in the DRM subsystem should scope power operations to runtime PM only; the DRM core drives system-wide transitions through the bridge enable() and disable() hooks.

Root Cause

The root cause is misuse of the deprecated UNIVERSAL_DEV_PM_OPS() helper, which conflates runtime PM and system sleep callbacks. In a DRM bridge driver, this design leads to redundant clock disable calls and an inconsistent power state.

Attack Vector

No remote or local attack vector is identified in the advisory. The impact is limited to a kernel warning, log noise, and potential driver state inconsistency during suspend on affected hardware. Consult the upstream commits referenced in the Kernel Git repository for the exact code change.

// No verified exploit code available for CVE-2026-68280.
// The defect is a power-management logic error, not a memory-safety issue.

Detection Methods for CVE-2026-68280

Indicators of Compromise

Kernel log entries matching clk:<id>:<count> already disabled on suspend
WARNING: CPU: <n> PID: <pid> at drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac
Call traces containing cdns_dsi_suspend, pm_generic_suspend, and dpm_suspend frames

Detection Strategies

Parse dmesg and journal logs for the clk_core_disable WARN signature on systems with the Cadence DSI bridge loaded
Correlate suspend/resume cycles with recurring warnings in kernel telemetry
Track the loaded state of the cdns_dsi module against the kernel version to identify unpatched hosts

Monitoring Recommendations

Forward kernel ring buffer and journalctl -k output to a central log store for search on already disabled strings
Alert on repeated WARNING events from drivers/clk/clk.c in fleets running affected kernels
Include kernel version and loaded DRM bridge modules in host inventory to prioritize patch rollout

How to Mitigate CVE-2026-68280

Immediate Actions Required

Identify hosts running the cdns_dsi bridge driver on kernels predating the fix
Apply the upstream stable kernel update that replaces UNIVERSAL_DEV_PM_OPS() with RUNTIME_PM_OPS() in cdns-dsi
Reboot affected devices after patching to reload the updated bridge module

Patch Information

The fix is available in the upstream stable tree across multiple branches. Reference commits: 1f9c6b74e796, 2d8b08844c0e, 347bc3a6a4d9, c0384d6872f4, and c18d46d9830c. Distributions should backport these commits into supported kernel packages.

Workarounds

Unload the cdns_dsi module on systems where the bridge is not required for display output
Avoid triggering system-wide suspend cycles on unpatched hosts using the Cadence DSI bridge
Track the WARN occurrences and treat them as advisory until the patched kernel is deployed

bash

# Verify whether the cdns-dsi bridge driver is loaded
lsmod | grep cdns_dsi

# Inspect kernel logs for the clock double-disable warning
dmesg | grep -E "already disabled|clk_core_disable|cdns_dsi_suspend"

# Check running kernel version against the patched stable release
uname -r