{"api_version":"1","generated_at":"2026-08-22T03:47:24+00:00","cve":"CVE-2026-72009","urls":{"html":"https://cve.report/CVE-2026-72009","api":"https://cve.report/api/cve/CVE-2026-72009.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72009","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72009"},"summary":{"title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:20:59","updated_at":"2026-08-17 06:17:58"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0","name":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c","name":"https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67","name":"https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72009","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72009","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 4fd5b33faf092ef2d09f730a7d9e49f9e976ac67 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 4ba6d7166750d0b810c6cfc0b1df7585f513b48c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e9aa77d413c903ba4cf7da3fe0b419cae5b97a81 99611233f8cda833169fa6487d5dacdf189e5cb0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72009","cve":"CVE-2026-72009","epss":"0.001610000","percentile":"0.058420000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pmdomain/imx/imx93-blk-ctrl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4fd5b33faf092ef2d09f730a7d9e49f9e976ac67","status":"affected","version":"e9aa77d413c903ba4cf7da3fe0b419cae5b97a81","versionType":"git"},{"lessThan":"4ba6d7166750d0b810c6cfc0b1df7585f513b48c","status":"affected","version":"e9aa77d413c903ba4cf7da3fe0b419cae5b97a81","versionType":"git"},{"lessThan":"99611233f8cda833169fa6487d5dacdf189e5cb0","status":"affected","version":"e9aa77d413c903ba4cf7da3fe0b419cae5b97a81","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pmdomain/imx/imx93-blk-ctrl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.1"},{"lessThan":"6.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access on an i.MX93 system to trigger MIPI DSI/CSI power-domain transitions via DRM display ioctls and V4L2 camera streaming on /dev/dri/* and /dev/video*; there is no network, Bluetooth, or physical USB attack path to this pmdomain driver.\nAC:L - On affected imx93 boards with both DSI and CSI enabled, an attacker can reliably reproduce the fault by starting a CSI capture (keeping the CSI genpd active) then suspending or closing the DSI path so imx93_blk_ctrl_power_off() clears shared PHY bit 12; no uncontrollable timing or rare layout is required.\nPR:L - Triggering the vulnerable power_off path needs only a local unprivileged application user able to open standard media device nodes (typical video/render group or embedded app account on automotive, kiosk, and industrial i.MX93 targets), not init-namespace root or capabilities unavailable via user namespaces.\nUI:N - No separate victim action is required when the attacker controls both display and camera interfaces on the same device; they can independently start CSI streaming and release DSI runtime PM to force premature shared PHY teardown.\nS:U - Impact is confined to kernel and on-chip media hardware on the same i.MX93 host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - Asserting reset and gating the shared MIPI PHY (BIT(12)) while CSI/DSI DMA is still active can leave media bus masters operating against powered-down hardware; on i.MX93 platforms without in-tree SMMU isolation this plausibly enables errant DMA reads exposing kernel or other process memory.\nI:H - The same premature PHY reset/clock gate during active capture or display transfers can cause misdirected media-master writes beyond intended buffers, corrupting arbitrary physical memory on affected embedded i.MX93 deployments where DMA is not IOMMU-contained.\nA:H - Disabling shared PHY resources while the sibling MIPI interface remains active causes camera/display failure, driver hangs, and potential kernel oops or panic from malfunctioning CSI/DSI hardware and interrupt storms on safety-critical embedded systems using concurrent display and camera."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:39:23.846Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67"},{"url":"https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c"},{"url":"https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}],"title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72009","datePublished":"2026-08-15T05:51:39.019Z","dateReserved":"2026-08-09T03:40:39.899Z","dateUpdated":"2026-08-17T05:39:23.846Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:20:59","lastModifiedDate":"2026-08-17 06:17:58","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72009","Ordinal":"1","Title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/C","CVE":"CVE-2026-72009","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72009","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use.","Type":"Description","Title":"pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/C"}]}}}