The vulnerability in the Linux kernel drm/msm/dpu subsystem involves a mismatch between power rail voltage and core clock frequency during DPU runtime suspend and resume. When dev_pm_opp_set_rate(dev, 0) is called during suspend, the MMCX power rail voltage drops to MIN_SVS, but the core clock frequency remains at its highest rate. Upon resume, only the clock is re-enabled without restoring the appropriate voltage level, causing the rail voltage to be insufficient for the clock frequency. This can lead to system instability or crashes. The fix removes the problematic call to dev_pm_opp_set_rate(dev, 0) from the dpu_runtime_suspend function to maintain correct voltage-frequency alignment.

This vulnerability can cause system instability or crashes due to the power rail voltage being too low to sustain the core clock frequency after DPU runtime resume. There is no impact on confidentiality or integrity, but availability is affected (denial of service).

A fix is available and has been applied in the Linux kernel by removing the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend. Users should update to the patched kernel version containing this fix. Patch status is confirmed by the vendor patchwork link. No additional mitigation is required beyond applying the official fix.