CVE-2026-97512

The Linux kernel driver for QCOM QSPI devices had incomplete error handling in its runtime power management routines. If the driver failed partway through suspend or resume, the module left system clocks, power states, and performance states mis‑synchronized. This inconsistency could cause brownout events and other power‑management problems, potentially destabilizing the system or degrading performance.

The vulnerability affects all Linux kernel builds that include the spi-qcom-qspi driver prior to the patch. No specific version numbers are listed; the issue exists in any kernel version that deployed the driver code before the fix. All devices that run the QCOM QSPI controller on the Linux kernel are potentially impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, implying no publicly known exploits have been observed. The likely attack vector involves a local attacker with root or kernel debugging privileges who can trigger suspend or resume operations to force a resource mis‑management scenario. Given the lack of exploit data, the focus is on preventing the erroneous state rather than mitigating a known exploit.