{"api_version":"1","generated_at":"2026-10-02T03:44:39+00:00","cve":"CVE-2026-89946","urls":{"html":"https://cve.report/CVE-2026-89946","api":"https://cve.report/api/cve/CVE-2026-89946.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89946","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89946"},"summary":{"title":"ASoC: cs35l33: drain threaded IRQ before runtime suspend","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: cs35l33: drain threaded IRQ before runtime suspend\n\ncs35l33_runtime_suspend() currently switches the codec into\nregcache_cache_only(true) and powers it down without first quiescing the\nthreaded IRQ registered by devm_request_threaded_irq(). That leaves a\nwindow where cs35l33_irq_thread() can still run after suspend has closed\noff live register access.\n\nA running system can reach this during runtime PM while the driver still\nhas critical fault IRQs unmasked. If the threaded handler runs in that\nwindow, it reads volatile INT_STATUS_1/2 after cache_only has been\nenabled, ignores the regmap_read() failures, and can still drive the\nAMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS release paths.\n\nUse disable_irq() before entering cache_only/power-off so any in-flight\nthreaded handler is drained and no new IRQ thread can run during the\nsuspended state. Re-enable the IRQ only after runtime_resume() has\nrestored live register access with regcache_sync(). Since probe only\nwarns if devm_request_threaded_irq() fails, track whether the IRQ was\nactually installed before disabling or re-enabling it.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-16 11:17:04","updated_at":"2026-09-16 11:17:04"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/d07799302721d381aef834fac8a11d196894eccb","name":"https://git.kernel.org/stable/c/d07799302721d381aef834fac8a11d196894eccb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5b5311427e54d9c0d07178ee42df68ba44c2d5ca","name":"https://git.kernel.org/stable/c/5b5311427e54d9c0d07178ee42df68ba44c2d5ca","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/614c2616ea677abfbed917a92bdc5141efff3536","name":"https://git.kernel.org/stable/c/614c2616ea677abfbed917a92bdc5141efff3536","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e074c12c428c633e079154301207a6079a208583","name":"https://git.kernel.org/stable/c/e074c12c428c633e079154301207a6079a208583","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6e369bc46663b4bfce3d5f8b8ed08e71ecea13a2","name":"https://git.kernel.org/stable/c/6e369bc46663b4bfce3d5f8b8ed08e71ecea13a2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6ae98918240585eb2ad32b097c4810f4e2dabe88","name":"https://git.kernel.org/stable/c/6ae98918240585eb2ad32b097c4810f4e2dabe88","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a04722542c76ce861031384480825afded8cc4f4","name":"https://git.kernel.org/stable/c/a04722542c76ce861031384480825afded8cc4f4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/84cf6acd01a1ec8f30276578a039216327af782e","name":"https://git.kernel.org/stable/c/84cf6acd01a1ec8f30276578a039216327af782e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89946","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89946","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 d07799302721d381aef834fac8a11d196894eccb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 5b5311427e54d9c0d07178ee42df68ba44c2d5ca git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 a04722542c76ce861031384480825afded8cc4f4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 614c2616ea677abfbed917a92bdc5141efff3536 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 6ae98918240585eb2ad32b097c4810f4e2dabe88 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 6e369bc46663b4bfce3d5f8b8ed08e71ecea13a2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 84cf6acd01a1ec8f30276578a039216327af782e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 e074c12c428c633e079154301207a6079a208583 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.270 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.221 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.51 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.5 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/soc/codecs/cs35l33.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d07799302721d381aef834fac8a11d196894eccb","status":"affected","version":"3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8","versionType":"git"},{"lessThan":"5b5311427e54d9c0d07178ee42df68ba44c2d5ca","status":"affected","version":"3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8","versionType":"git"},{"lessThan":"a04722542c76ce861031384480825afded8cc4f4","status":"affected","version":"3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8","versionType":"git"},{"lessThan":"614c2616ea677abfbed917a92bdc5141efff3536","status":"affected","version":"3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8","versionType":"git"},{"lessThan":"6ae98918240585eb2ad32b097c4810f4e2dabe88","status":"affected","version":"3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8","versionType":"git"},{"lessThan":"6e369bc46663b4bfce3d5f8b8ed08e71ecea13a2","status":"affected","version":"3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8","versionType":"git"},{"lessThan":"84cf6acd01a1ec8f30276578a039216327af782e","status":"affected","version":"3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8","versionType":"git"},{"lessThan":"e074c12c428c633e079154301207a6079a208583","status":"affected","version":"3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/soc/codecs/cs35l33.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.8"},{"lessThan":"4.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.270","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.51","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.270","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.221","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.51","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.5","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: cs35l33: drain threaded IRQ before runtime suspend\n\ncs35l33_runtime_suspend() currently switches the codec into\nregcache_cache_only(true) and powers it down without first quiescing the\nthreaded IRQ registered by devm_request_threaded_irq(). That leaves a\nwindow where cs35l33_irq_thread() can still run after suspend has closed\noff live register access.\n\nA running system can reach this during runtime PM while the driver still\nhas critical fault IRQs unmasked. If the threaded handler runs in that\nwindow, it reads volatile INT_STATUS_1/2 after cache_only has been\nenabled, ignores the regmap_read() failures, and can still drive the\nAMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS release paths.\n\nUse disable_irq() before entering cache_only/power-off so any in-flight\nthreaded handler is drained and no new IRQ thread can run during the\nsuspended state. Re-enable the IRQ only after runtime_resume() has\nrestored live register access with regcache_sync(). Since probe only\nwarns if devm_request_threaded_irq() fails, track whether the IRQ was\nactually installed before disabling or re-enabling it."}],"providerMetadata":{"dateUpdated":"2026-09-16T10:32:32.675Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/d07799302721d381aef834fac8a11d196894eccb"},{"url":"https://git.kernel.org/stable/c/5b5311427e54d9c0d07178ee42df68ba44c2d5ca"},{"url":"https://git.kernel.org/stable/c/a04722542c76ce861031384480825afded8cc4f4"},{"url":"https://git.kernel.org/stable/c/614c2616ea677abfbed917a92bdc5141efff3536"},{"url":"https://git.kernel.org/stable/c/6ae98918240585eb2ad32b097c4810f4e2dabe88"},{"url":"https://git.kernel.org/stable/c/6e369bc46663b4bfce3d5f8b8ed08e71ecea13a2"},{"url":"https://git.kernel.org/stable/c/84cf6acd01a1ec8f30276578a039216327af782e"},{"url":"https://git.kernel.org/stable/c/e074c12c428c633e079154301207a6079a208583"}],"title":"ASoC: cs35l33: drain threaded IRQ before runtime suspend","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89946","datePublished":"2026-09-16T10:32:32.675Z","dateReserved":"2026-09-11T19:38:34.777Z","dateUpdated":"2026-09-16T10:32:32.675Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 11:17:04","lastModifiedDate":"2026-09-16 11:17:04","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89946","Ordinal":"1","Title":"ASoC: cs35l33: drain threaded IRQ before runtime suspend","CVE":"CVE-2026-89946","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89946","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: cs35l33: drain threaded IRQ before runtime suspend\n\ncs35l33_runtime_suspend() currently switches the codec into\nregcache_cache_only(true) and powers it down without first quiescing the\nthreaded IRQ registered by devm_request_threaded_irq(). That leaves a\nwindow where cs35l33_irq_thread() can still run after suspend has closed\noff live register access.\n\nA running system can reach this during runtime PM while the driver still\nhas critical fault IRQs unmasked. If the threaded handler runs in that\nwindow, it reads volatile INT_STATUS_1/2 after cache_only has been\nenabled, ignores the regmap_read() failures, and can still drive the\nAMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS release paths.\n\nUse disable_irq() before entering cache_only/power-off so any in-flight\nthreaded handler is drained and no new IRQ thread can run during the\nsuspended state. Re-enable the IRQ only after runtime_resume() has\nrestored live register access with regcache_sync(). Since probe only\nwarns if devm_request_threaded_irq() fails, track whether the IRQ was\nactually installed before disabling or re-enabling it.","Type":"Description","Title":"ASoC: cs35l33: drain threaded IRQ before runtime suspend"}]}}}