CVE-2026-68463

Received Received - Intake

Runtime PM Fix in Linux Kernel sdhci-esdhc-imx

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() to simplify error handling. pm_runtime_resume_and_get() automatically drops the usage counter on failure, avoiding the need for a separate pm_runtime_put_noidle() call. If it fails, the device is unclocked and accessing hardware registers would cause a kernel panic, so return the error immediately.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-68463

EUVD

EUVD-2026-59085

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's mmc sdhci-esdhc-imx driver. It involves replacing pm_runtime_get_sync() with pm_runtime_resume_and_get() to improve error handling. The new function automatically drops the usage counter on failure, preventing the need for a separate pm_runtime_put_noidle() call. If pm_runtime_resume_and_get() fails, the device becomes unclocked, which could cause a kernel panic when accessing hardware registers.

Detection Guidance

This vulnerability is specific to the Linux kernel's mmc sdhci-esdhc-imx driver and does not have a direct detection method through network or system commands. It involves a code change in the kernel's power management handling. To check if your system is affected, verify the kernel version and the presence of the vulnerable code pattern in the sdhci-esdhc-imx driver.

Impact Analysis

This vulnerability could lead to system instability or crashes (kernel panics) if the device fails to resume properly during suspend operations. Users might experience unexpected system freezes or reboots when the affected driver interacts with storage hardware.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel driver issue involving error handling in power management functions.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. The specific change involves replacing pm_runtime_get_sync() with pm_runtime_resume_and_get() in the sdhci-esdhc-imx driver.

Hi! I’m here to help you understand CVE-2026-68463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70