CVE-2026-93145

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

gdsc_unregister() removes the OF provider entry and tears down the

parent/subdomain wiring, but never calls pm_genpd_remove() on the

individual generic_pm_domain structures registered by gdsc_init():

void gdsc_unregister(struct gdsc_desc *desc)

{

struct device *dev = desc->dev;

size_t num = desc->num;

gdsc_pm_subdomain_remove(desc, num);

of_genpd_del_provider(dev->of_node);

}

That leaves dangling entries on the global gpd_list. After a provider

unbind/rebind cycle (deferred-probe replay during early boot, real

module unload of a clk driver that owns GDSCs, or an OF-overlay tear-

down) the next gdsc_init() will end up trying to re-register a name

that is still in the list and pm_genpd_init() returns -EEXIST.

While we are here, flip the order so the consumer-facing OF provider

entry is the first thing removed -- otherwise a fresh

of_genpd_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References