CVE-2026-89946ASoC: cs35l33: drain threaded IRQ before runtime suspend
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l33: drain threaded IRQ before runtime suspend cs35l33_runtime_suspend() currently switches the codec into regcache_cache_only(true) and powers it down without first quiescing the threaded IRQ registered by devm_request_threaded_irq(). That leaves a window where cs35l33_irq_thread() can still run after suspend has closed off live register access. A running system can reach this during runtime PM while the driver still has critical fault IRQs unmasked. If the threaded handler runs in that window, it reads volatile INT_STATUS_1/2 after cache_only has been enabled, ignores the regmap_read() failures, and can still drive the AMP_SHORT_RLS, CAL_ERR_RLS, OTE_RLS, and OTW_RLS release paths. Use disable_irq() before entering cache_only/power-off so any in-flight threaded handler is drained and no new IRQ thread can run during the suspended state. Re-enable the IRQ only after runtime_resume() has restored live register access with regcache_sync(). Since probe only warns if devm_request_threaded_irq() fails, track whether the IRQ was actually installed before disabling or re-enabling it.
Timeline
ID reserved
By Linux
- 5 days later
· 5 days later
Published
- 33 days later
· 33 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 88% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 – < d07799302721d381aef834fac8a11d196894eccb
- affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 – < 5b5311427e54d9c0d07178ee42df68ba44c2d5ca
- affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 – < a04722542c76ce861031384480825afded8cc4f4
- affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 – < 614c2616ea677abfbed917a92bdc5141efff3536
- affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 – < 6ae98918240585eb2ad32b097c4810f4e2dabe88
- affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 – < 6e369bc46663b4bfce3d5f8b8ed08e71ecea13a2
- affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 – < 84cf6acd01a1ec8f30276578a039216327af782e
- affected 3333cb7187b9c8d28f7a6405bbe9cec7a10efdc8 – < e074c12c428c633e079154301207a6079a208583
- affected 4.8
- unaffected < 4.8
- unaffected 5.10.270 – ≤ 5.10.*
- unaffected 5.15.221 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.51 – ≤ 6.18.*
- unaffected 7.2.5 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/d07799302721d381aef834fac8a11d196894eccb (opens in a new tab)
- https://git.kernel.org/stable/c/5b5311427e54d9c0d07178ee42df68ba44c2d5ca (opens in a new tab)
- https://git.kernel.org/stable/c/a04722542c76ce861031384480825afded8cc4f4 (opens in a new tab)
- https://git.kernel.org/stable/c/614c2616ea677abfbed917a92bdc5141efff3536 (opens in a new tab)
- https://git.kernel.org/stable/c/6ae98918240585eb2ad32b097c4810f4e2dabe88 (opens in a new tab)
- https://git.kernel.org/stable/c/6e369bc46663b4bfce3d5f8b8ed08e71ecea13a2 (opens in a new tab)
- https://git.kernel.org/stable/c/84cf6acd01a1ec8f30276578a039216327af782e (opens in a new tab)
- https://git.kernel.org/stable/c/e074c12c428c633e079154301207a6079a208583 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-80546 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89946)Record last updated .