CVE-2026-72260

Received Received - Intake

Kernel ASoc Runtime PM Flaw in MediaTek MT8192

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192: Check runtime resume during probe The MT8192 AFE probe enables runtime PM temporarily while reinitializing the regmap cache from hardware, but it uses pm_runtime_get_sync() without checking the return value. If runtime resume fails, probe keeps going without the device necessarily being accessible, and pm_runtime_get_sync() may leave the PM usage count incremented. The regmap_reinit_cache() failure path also returns before dropping the temporary PM reference and before clearing pm_runtime_bypass_reg_ctl. Use pm_runtime_resume_and_get() so resume failures do not leak a usage count, and clear the temporary bypass flag after dropping the probe PM reference on all regmap_reinit_cache() outcomes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72260

EUVD

EUVD-2026-59159

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's ASoC driver for the MT8192 chipset. During probe initialization, the driver temporarily enables runtime power management but fails to check if the resume operation succeeds. If resume fails, the device may not be accessible while the power management usage count remains incorrectly incremented. This can lead to system instability or improper device state management.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC subsystem for the MT8192 platform. Detection requires checking kernel logs for probe failures or runtime PM issues related to the mt8192-afe driver. Use commands like dmesg | grep mt8192 or journalctl -k | grep -i 'afe' to inspect kernel messages for errors during device probe or runtime PM operations.

Impact Analysis

This vulnerability could cause audio subsystem failures on devices using the MT8192 chipset. It may result in sound not working properly or system crashes during boot or runtime. The incorrect power management state could also lead to unexpected behavior in audio applications or system instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue related to runtime power management and does not involve data handling, access controls, or privacy concerns that these regulations address.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel updates from your distribution and apply them promptly. If you cannot update immediately, consider disabling the affected mt8192-afe driver if not in use, but this may impact audio functionality.

Hi! I’m here to help you understand CVE-2026-72260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70