CVE-2026-89721: Linux Kernel Rockchip PHY DoS Vulnerability

CVE-2026-89721 Overview

CVE-2026-89721 is a Linux kernel vulnerability in the phy-rockchip-samsung-dcphy driver. The driver defines max_register as 0x10000, which points one register past the end of the 64KB PHY register mapping. When userspace dumps registers through the regmap debugfs interface, the read extends beyond the ioremapped region and triggers an oops on the unmapped page. The oops occurs while the regmap lock is held, so subsequent PHY operations deadlock. The upstream fix corrects max_register to the last valid offset at 0xfffc.

Critical Impact
A local user with access to regmap debugfs can trigger a kernel oops and deadlock all further PHY operations on affected Rockchip Samsung DCPHY hardware.

Affected Products

Linux kernel builds including the phy-rockchip-samsung-dcphy driver
Rockchip platforms using the Samsung D-PHY/C-PHY combo controller
Distributions shipping vulnerable stable kernels prior to the referenced fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89721 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89721

Vulnerability Analysis

The phy-rockchip-samsung-dcphy driver registers a regmap for the PHY register block. The block is 64KB in size, and with a 4-byte register stride the last valid register address is 0xfffc. The driver incorrectly sets max_register to 0x10000, which is one register beyond the mapped region.

The regmap debugfs interface iterates from offset zero up to max_register when a user reads the registers file. The final iteration issues an ioread32 at 0x10000, which lies on an unmapped page immediately after the ioremapped MMIO window. The access faults and the kernel oopses.

Because the read occurs inside the regmap lock, the lock is never released. Any subsequent PHY code path that touches the same regmap blocks indefinitely, producing a hard deadlock across display, MIPI, and downstream subsystems that depend on the PHY.

Root Cause

The root cause is an off-by-one boundary definition in the regmap configuration structure. max_register names the highest addressable register, not one past the end. Setting it to the mapping size rather than mapping_size - stride causes the regmap core to attempt an out-of-bounds MMIO read. This is an out-of-bounds read of kernel memory-mapped I/O space.

Attack Vector

Exploitation requires local access to the regmap debugfs interface, which is typically restricted to root. A privileged local user reading /sys/kernel/debug/regmap/<phy-device>/registers triggers the fault. The result is a denial of service through kernel oops and regmap lock deadlock rather than code execution or privilege escalation.

See the upstream fixes for technical details: Kernel Git Commit 14afe18, Kernel Git Commit 4486e75, and Kernel Git Commit c1a62f9.

Detection Methods for CVE-2026-89721

Indicators of Compromise

Kernel oops messages referencing regmap_debugfs, regmap_read, or rockchip_samsung_dcphy in dmesg or /var/log/kern.log.
Page fault entries whose faulting address falls immediately after a PHY MMIO region on Rockchip SoCs.
Processes stuck in uninterruptible sleep on the PHY regmap mutex after a debugfs read.

Detection Strategies

Audit kernel version and driver source to confirm whether max_register in phy-rockchip-samsung-dcphy.c equals 0x10000 or the patched value 0xfffc.
Correlate crash telemetry with recent access to /sys/kernel/debug/regmap/* on Rockchip platforms.
Track display or MIPI subsystem hangs that immediately follow a regmap debugfs interaction.

Monitoring Recommendations

Ship dmesg and kernel crash dumps to a central log store and alert on Oops or BUG strings originating in regmap or PHY code paths.
Monitor for repeated soft lockups or hung task warnings on Rockchip devices after PHY-related operations.
Watch for unexpected reboots on embedded and edge devices running affected kernels.

How to Mitigate CVE-2026-89721

Immediate Actions Required

Update to a Linux stable kernel that includes commits 14afe18, 4486e75, or c1a62f9, whichever applies to your maintained branch.
Restrict access to /sys/kernel/debug on production Rockchip systems until the patched kernel is deployed.
Inventory embedded and edge devices running Rockchip SoCs to identify systems shipping vulnerable kernels.

Patch Information

The upstream fix changes max_register from 0x10000 to 0xfffc so the regmap core stops iterating at the last valid register. Patches are available in the mainline and stable trees at Kernel Git Commit 14afe18, Kernel Git Commit 4486e75, and Kernel Git Commit c1a62f9. Rebuild vendor kernels or wait for a distribution-provided update.

Workarounds

Build the kernel with CONFIG_DEBUG_FS=n or mount debugfs with restricted permissions to prevent register dumps.
Remove or unbind the phy-rockchip-samsung-dcphy driver on systems that do not require Rockchip DCPHY functionality.
Enforce that only trusted administrators can read /sys/kernel/debug/regmap/* files.

bash

# Restrict debugfs access to root and prevent regmap register dumps
mount -o remount,mode=0700 /sys/kernel/debug
chmod 0700 /sys/kernel/debug