In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime… (CVE-2026-99034)

The Linux kernel vulnerability CVE-2026-99034 affects the mmc sdhci-sprd driver. The driver enables runtime power management (PM) during the probe phase but fails to perform corresponding runtime PM cleanup during device removal. Specifically, the normal remove path disables clocks that are also managed by runtime PM callbacks without resuming the device first. If the device is runtime suspended, these clocks may already be disabled, causing potential inconsistencies. The fix involves resuming the device before removal, disabling runtime PM, and dropping the temporary runtime PM reference before disabling the clocks. This issue was identified through manual code inspection.

The vulnerability could cause improper handling of device clocks during removal, potentially leading to inconsistent device states or system instability related to power management. There is no indication of direct security exploitation or data compromise. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to properly handle runtime PM during device removal in the sdhci-sprd driver. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.