CVE-2026-53056: Linux Kernel DPU Power-Frequency Mismatch Causes System Instability

Technical summary

The vulnerability exists in the MSM DPU (Display Processing Unit) runtime PM implementation within the Linux kernel. Specifically, calling dev_pm_opp_set_rate(dev, 0) during dpu_runtime_suspend() reduces the MMCX power rail to MIN_SVS operating point while the DPU core clock frequency remains at its previously configured (maximum) rate. This creates a voltage-frequency mismatch. When runtime resume occurs and re-enables the clock without restoring the voltage to an appropriate level first, the MMCX rail operating at MIN_SVS cannot safely support the core clock operating at maximum frequency, potentially triggering hardware faults, cache coherency issues, or system hangs. The resolution involves removing the problematic dev_pm_opp_set_rate(dev, 0) call and allowing the voltage and frequency to remain coherent throughout the suspend-resume cycle.

Business impact

This vulnerability affects system stability on Qualcomm-based Linux devices with MSM DPU hardware, particularly mobile devices, tablets, and embedded systems using the affected kernel versions. For users, the impact ranges from display corruption and UI freezes to sudden reboots or device lockups during normal operation as the display subsystem transitions between power states. For organizations managing fleets of Linux-based embedded or mobile devices, this could result in unexpected device failures, support tickets, and reduced user productivity. Enterprise deployments relying on display-intensive workloads or continuous operation may experience unplanned downtime.

Affected systems

The Linux kernel is affected, specifically the DPU subsystem used in Qualcomm MSM platforms. This impacts devices running Linux kernels with the vulnerable DPU driver code path, particularly those where runtime PM suspend/resume cycles are frequent—such as smartphones, tablets, and other portable devices with Qualcomm SoCs. The vulnerability does not require specific user interaction; any normal power management activity can trigger the issue.

Exploitability

This is not a traditional security vulnerability exploitable for privilege escalation, data theft, or unauthorized access. Rather, it is a reliability and stability defect triggered by normal system operation. Any user or unprivileged process running on an affected device can indirectly trigger the suspend-resume cycle through standard power management (screen lock, idle timeout, or explicit sleep), making it trivial to encounter in regular usage. No special knowledge, tools, or elevated privileges are required to cause the mismatch. Exploitation by adversaries could involve inducing display-suspend cycles to destabilize a target system.

Remediation

Remove the dev_pm_opp_set_rate(dev, 0) call from the dpu_runtime_suspend() function to prevent premature voltage reduction. This ensures the power rail and clock frequency remain synchronized during suspend and resume transitions. The fix has been submitted to the kernel community via the Freedesktop patchwork system. Affected users should apply the kernel patch once it is available in a stable release or pull it from the kernel maintainer's tree.

Patch guidance

Consult your Linux distribution or device manufacturer for a kernel update that includes the fix for this DPU power-frequency mismatch. The upstream patch is tracked in the Freedesktop patchwork system (referenced in the vulnerability details). If you maintain custom kernel builds, apply the patch that removes the incorrect dev_pm_opp_set_rate(dev, 0) call during DPU runtime suspend. Verify that after patching, DPU suspend and resume cycles complete without log errors related to voltage or frequency mismatches. Test on representative hardware to confirm display stability during idle and wake transitions.

Detection guidance

Monitor system logs for repeated warnings or errors related to DPU voltage/frequency mismatches, power rail violations, or hardware faults during display state transitions. Look for kernel messages containing 'DPU', 'MMCX', 'opp_set_rate', or 'runtime_suspend' followed by stability issues or crashes. On affected devices, enable kernel debugging (CONFIG_DEBUG_PM if available) to capture additional power management state transitions. Correlate display sleep/wake events in the timeline with system resets, hangs, or UI freezes. Test the vulnerability on staging devices by inducing rapid display suspend-resume cycles and observing for crashes or log warnings within minutes.

Why prioritize this

Although rated MEDIUM severity due to its availability impact (system crashes) without confidentiality or integrity implications, this vulnerability should be prioritized for devices in active deployment. Frequent, unpredictable system crashes degrade user experience and can cause data loss if processes are interrupted mid-operation. Embedded systems and mobile devices relying on continuous operation are at higher risk. The fix is straightforward with no known side effects, making remediation low-friction once patches are available.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects an attack vector of local (AV:L)—the vulnerability cannot be exploited remotely—with low attack complexity (AC:L) and no privilege requirement (PR:L/UI:N). The impact is limited to availability (A:H); there is no confidentiality or integrity loss. The score accurately captures that any local user can trigger the defect through normal system operation, leading to system instability or denial of service, but the attack surface is confined to local power management and no authentication bypass or data compromise occurs.

Frequently asked questions