Unscored severity · published Oct 26, 2026
CVE-2026-99089
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
New
–
CVSS
0.2%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
The probe function puts the device into the runtime PM active state with
only the "iis" bus clock enabled, but it also sets priv->op_clk to the
parent of the RCLK_SRC mux without enabling it. The runtime PM suspend
callback disables both clocks, so the first runtime suspend after probe
disables op_clk once more than it was enabled.
On Exynos5250 Arndale both clocks resolve to the same EXYNOS_I2S_BUS gate,
so this triggers the following warning during boot:
WARNING: drivers/clk/clk.c:1270 at clk_core_disable+0xe4/0x23c, CPU#0: kworker/u8:3/45
i2s_bus already disabled
...
Workqueue: pm pm_runtime_work
Call trace:
...
clk_core_disable from clk_disable+0x28/0x34
clk_disable from i2s_runtime_suspend+0x58/0x68 [snd_soc_i2s]
i2s_runtime_suspend [snd_soc_i2s] from genpd_runtime_suspend+0xc4/0x298
genpd_runtime_suspend from __rpm_callback+0x48/0x18c
__rpm_callback from rpm_callback+0x4c/0x50
rpm_callback from rpm_suspend+0xf4/0x718
rpm_suspend from pm_runtime_work+0x9c/0xa0
...
Fix this by enabling op_clk in probe right after getting it, so the clock
state matches the runtime PM active state, and by disabling it in remove.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
48279c53fd1d09dc0d1b6ebb9f21732c507cea0b before 2c64c30d493d82d5edc95811cede0083e1195822; 48279c53fd1d09dc0d1b6ebb9f21732c507cea0b before 5dac6bf09b5a4fff2433629801309c3884c3e94a; 48279c53fd1d09dc0d1b6ebb9f21732c507cea0b before 64bb35079dcbc67901da1fe8c52c234cbcd17df3; 48279c53fd1d09dc0d1b6ebb9f21732c507cea0b before a728c12f8bd89947894e227d0f4f83a895ac9ab7; 48279c53fd1d09dc0d1b6ebb9f21732c507cea0b before 7529254014764ae0b8c33d5c61a58f36c65b1a1c; 4.17 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-99089
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-99089
git.kernel.org
https://git.kernel.org/stable/c/2c64c30d493d82d5edc95811cede0083e1195822
git.kernel.org
https://git.kernel.org/stable/c/5dac6bf09b5a4fff2433629801309c3884c3e94a
git.kernel.org
https://git.kernel.org/stable/c/64bb35079dcbc67901da1fe8c52c234cbcd17df3
git.kernel.org
https://git.kernel.org/stable/c/7529254014764ae0b8c33d5c61a58f36c65b1a1c
git.kernel.org
https://git.kernel.org/stable/c/a728c12f8bd89947894e227d0f4f83a895ac9ab7
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.8
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
