CVE-2026-89946 Overview
CVE-2026-89946 is a race condition in the Linux kernel ASoC: cs35l33 codec driver. The cs35l33_runtime_suspend() function switches the codec into regcache_cache_only(true) and powers it down without first quiescing the threaded IRQ registered by devm_request_threaded_irq(). This leaves a window where cs35l33_irq_thread() can still execute after suspend has closed off live register access. The threaded handler can then read volatile INT_STATUS_1/2 registers, ignore regmap_read() failures, and drive the AMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS release paths against a suspended device.
Critical Impact
A threaded IRQ handler can execute concurrently with runtime suspend, producing unpredictable register operations and driver state corruption on affected audio hardware.
Affected Products
- Linux kernel branches shipping the sound/soc/codecs/cs35l33 driver
- Systems using Cirrus Logic CS35L33 audio codecs with runtime power management enabled
- Distributions that had not applied the upstream stable kernel fixes referenced in the advisory
Discovery Timeline
- 2026-09-16 - CVE-2026-89946 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89946
Vulnerability Analysis
The defect is a race condition between runtime power management and the threaded interrupt handler in the CS35L33 codec driver. When cs35l33_runtime_suspend() runs, it enables regcache_cache_only(true) and powers the codec down. Because the threaded IRQ registered through devm_request_threaded_irq() is not disabled first, an in-flight or newly scheduled cs35l33_irq_thread() invocation can execute while the device is unreachable.
Once cache-only mode is active, regmap_read() calls against volatile registers such as INT_STATUS_1 and INT_STATUS_2 fail. The handler ignores these failures and proceeds to run the fault release paths — AMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS — against powered-down hardware. This produces inconsistent driver state, spurious fault handling, and potential loss of critical short-circuit and thermal protection semantics.
Root Cause
The root cause is missing IRQ synchronization during the runtime PM transition. The suspend path modifies register-access state without calling disable_irq() to drain any pending threaded handler. The upstream fix uses disable_irq() before entering cache-only and power-off, then re-enables the IRQ after runtime_resume() restores live register access with regcache_sync(). Because probe only warns if devm_request_threaded_irq() fails, the fix also tracks whether the IRQ was actually installed before disabling or re-enabling it.
Attack Vector
This issue is a local, kernel-internal race triggered by normal runtime PM activity on systems with unmasked critical fault IRQs. No remote attack vector is described in the advisory. Impact is limited to systems with the affected codec hardware and requires the kernel to enter runtime suspend while IRQs remain armed. Refer to the kernel stable commits for the exact code changes.
Detection Methods for CVE-2026-89946
Indicators of Compromise
- Kernel log entries from the cs35l33 driver reporting regmap_read() failures on INT_STATUS_1 or INT_STATUS_2 around runtime PM transitions
- Unexpected invocations of AMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, or OTW_RLS release paths while the codec is suspended
- Audio subsystem instability or codec state desynchronization following runtime suspend/resume cycles
Detection Strategies
- Inventory Linux systems and compare running kernel versions against the fixed commits listed in the advisory
- Audit dmesg output for cs35l33 warnings correlated with runtime PM events
- Use configuration management tooling to flag kernels lacking the referenced stable patches
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM platform and alert on repeated cs35l33 register access errors
- Track kernel package versions across the fleet and identify hosts still running vulnerable builds
- Monitor audio subsystem crash and reset counters on devices using the affected codec
How to Mitigate CVE-2026-89946
Immediate Actions Required
- Identify systems running kernels that include the sound/soc/codecs/cs35l33 driver with runtime PM enabled
- Apply the upstream stable kernel updates referenced in the advisory and reboot affected hosts
- Where patching is delayed, evaluate whether runtime PM can be disabled for the affected codec as a temporary control
Patch Information
The fix has been merged across multiple stable kernel branches. Relevant commits include 5b53114, 614c261, 6ae9891, 6e369bc, 84cf6ac, a047225, d077993, and e074c12. Consume the fix through your Linux distribution's kernel update channel.
Workarounds
- Disable runtime power management for the CS35L33 codec on affected systems until a patched kernel is deployed
- Restrict use of hardware that depends on the affected driver in environments where kernel updates cannot be applied promptly
- Track upstream stable kernel releases and align internal patch cycles with the referenced commits
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.