{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"47e105bdc863f2b320f9c05c80a63d3b83312700","status":"affected","version":"50c63491ff267f2860a6d8cb70c9a30ab701b9d3","versionType":"git"},{"lessThan":"d33373c565af9c8a28776af02bd20ba6e5724211","status":"affected","version":"50c63491ff267f2860a6d8cb70c9a30ab701b9d3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-99248","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: xiic: restore non-managed runtime PM to fix clk WARN flood\n\nThe devres conversion replaced manual pm_runtime_enable()/disable() with\ndevm_pm_runtime_set_active_enabled() and dropped the remove-time runtime\nPM teardown. The managed release tears runtime PM down in the wrong\norder: it calls pm_runtime_dont_use_autosuspend() before\npm_runtime_disable(), i.e. while runtime PM is still enabled, and devres\nis LIFO so the devm_clk_get_enabled() release runs afterwards.\n\nAt remove(), pm_runtime_put_sync() leaves the device active with the\nautosuspend timer armed. Clearing use_autosuspend then makes rpm_idle()\nsuspend immediately, and xiic_i2c_runtime_suspend() clk_disable()s the\nclock. The later devm_clk_get_enabled() release clk_disable_unprepare()s\nthe already-disabled clock, so clk_core_disable() WARNs (\"clkN already\ndisabled\") on every teardown.\n\nDrop the managed helper and restore the non-managed runtime PM setup and\nteardown, so runtime PM is enabled once in probe and disabled once in\nremove and the clock enable count stays balanced.\n\nOrder the remove teardown so runtime PM is disabled before the usage\ncount is dropped: pm_runtime_disable() followed by pm_runtime_put_noidle()\ninstead of pm_runtime_put_sync(). Dropping the count first with autosuspend\nstill enabled arms the autosuspend timer, and a preemption before\npm_runtime_disable() lets it expire, suspend the device and clk_disable()\nthe clock, which the devm release then disables again - the same WARN.\n\nRestore the non-managed IRQ request as well. The probe error paths now\nunwind runtime PM by hand via goto, and a devm-registered handler is only\nfreed later during devres unwind, so it would stay live across the manual\nteardown (and across any future failing step added after it). Request the\nIRQ with request_threaded_irq() and free it explicitly in the probe error\npath and in remove. The probe error path also clears use_autosuspend, to\nmatch the teardown in remove().","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793704706478,"publishedAt":1793704706478,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/47e105bdc863f2b320f9c05c80a63d3b83312700"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d33373c565af9c8a28776af02bd20ba6e5724211"}],"remediation":[],"revision":"e310e814a9bc4c5db28c24a874271fdbcee665fe0887087bc5bbca7e54a847ed","sources":[{"modifiedAt":1793704706478,"name":"CNA: Linux","retrievedAt":1793707725924,"url":"https://www.cve.org/CVERecord?id=CVE-2026-99248"}],"ssvc":null,"status":"published","title":"i2c: xiic: restore non-managed runtime PM to fix clk WARN flood","updatedAt":1793707725924}