CVE-2026-89945 Overview
CVE-2026-89945 is a race condition in the Linux kernel's cs35l34 ASoC (ALSA System on Chip) codec driver. The cs35l34_runtime_suspend() function transitions the codec into regcache_cache_only(true), asserts reset low, and powers the device off without first quiescing the threaded interrupt request (IRQ) registered by devm_request_threaded_irq(). This creates a window during which cs35l34_irq_thread() can still execute after suspend has removed live hardware access. The upstream fix drains the in-flight threaded handler using disable_irq() before entering the suspend path.
Critical Impact
A threaded IRQ handler can run against a suspended codec, issuing register writes through a cache-only regmap and potentially executing the PROT_RELEASE_CTL release sequence or BST fault power-down writes without live hardware access.
Affected Products
- Linux kernel builds that include the sound/soc/codecs/cs35l34 ASoC driver
- Systems using the Cirrus Logic CS35L34 boosted audio amplifier with runtime power management enabled
- Distributions shipping kernels prior to the stable commits referenced in the advisory
Discovery Timeline
- 2026-09-16 - CVE-2026-89945 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89945
Vulnerability Analysis
The defect resides in the runtime power management path of the cs35l34 codec driver. The driver registers a threaded IRQ using devm_request_threaded_irq() to service critical fault interrupts such as boost converter (BST) faults and protection state changes. When runtime suspend is invoked, the driver switches the regmap into cache-only mode, drives the reset line low, and cuts power to the device. However, the suspend routine does not first drain pending IRQ threads.
Because the threaded handler can be scheduled independently of the suspend flow, cs35l34_irq_thread() may execute after the driver has already disabled live hardware access. In that window, the handler reads volatile registers INT_STATUS_1 through INT_STATUS_4, ignores the resulting regmap_read() failures, and continues into fault-handling paths that issue writes to the device.
Root Cause
The suspend routine treats the codec as fully quiesced without accounting for asynchronous threaded IRQ execution. Missing synchronization between cs35l34_runtime_suspend() and the threaded IRQ handler allows the handler to observe an inconsistent driver state. Additionally, probe-time behavior only logs request_threaded_irq() failures and continues, so the driver must also track whether the IRQ was successfully installed before attempting to disable or re-enable it.
Attack Vector
This is a kernel-local race condition triggered during normal runtime PM activity on systems with the cs35l34 codec present and its fault IRQs unmasked. Exploitation is not a remote code execution scenario. The observable impact is driver misbehavior, including erroneous execution of the PROT_RELEASE_CTL release sequence or BST fault power-down writes while the device is powered down, which can lead to inconsistent device state or system instability during audio subsystem power transitions.
No public proof-of-concept exploit is referenced in the advisory. The fix uses disable_irq() before entering the cache-only, reset-low, power-off sequence to drain any in-flight threaded handler, and re-enables the IRQ only after runtime_resume() restores live register access with regcache_sync(). See the upstream fixes in the Kernel Git Commit 5b06373 and Kernel Git Commit 07a8657 references.
Detection Methods for CVE-2026-89945
Indicators of Compromise
- Kernel log entries showing regmap_read() or regmap_write() failures originating from cs35l34_irq_thread() during or immediately after runtime suspend transitions.
- Unexpected audio subsystem faults or codec state resets on systems using the CS35L34 amplifier.
- Runtime PM traces showing threaded IRQ activity timestamped after cs35l34_runtime_suspend() completion.
Detection Strategies
- Audit installed kernel packages against the fixed stable commits listed in the advisory to identify vulnerable builds.
- Instrument the ASoC subsystem with kernel tracing (ftrace, trace-cmd) to correlate cs35l34_irq_thread invocations with runtime PM state transitions.
- Review dmesg on affected hardware for repeated regmap access failures tied to the cs35l34 driver.
Monitoring Recommendations
- Track kernel version and patch level inventory across Linux fleets to confirm coverage of the stable branches referenced in the advisory.
- Forward kernel messages to a centralized log platform and alert on repeated ASoC codec errors correlated with power management events.
- Monitor hardware telemetry from devices that ship the CS35L34 amplifier for unexpected reset or fault events.
How to Mitigate CVE-2026-89945
Immediate Actions Required
- Identify systems running kernels that include the vulnerable cs35l34 driver and prioritize them for update.
- Apply the stable kernel updates that incorporate the upstream fix draining the threaded IRQ before runtime suspend.
- Validate that vendor-supplied kernels or downstream distribution kernels have backported the referenced commits.
Patch Information
The fix is available across multiple stable branches. Refer to the upstream commits: Kernel Git Commit 07a8657, Kernel Git Commit 3be8380, Kernel Git Commit 4105a4c, Kernel Git Commit 4fe8a91, Kernel Git Commit 5a4fe7a, Kernel Git Commit 5b06373, Kernel Git Commit 9698273, and Kernel Git Commit f4bfd75.
Workarounds
- On systems that do not use the CS35L34 amplifier, blacklist the snd_soc_cs35l34 module to remove the vulnerable code path entirely.
- Where feasible, disable runtime power management for the affected codec until the patched kernel is deployed.
- Coordinate with hardware vendors for firmware or device-tree updates that reduce fault IRQ churn during suspend transitions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
