Bug 2516655 (CVE-2026-68463)

Summary: CVE-2026-68463 kernel: mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel, specifically within the `mmc: sdhci-esdhc-imx` component responsible for managing multimedia card (MMC) host controllers. During system suspend operations, an error in power management could cause the system to attempt accessing hardware that is not properly initialized. This improper access would lead to a kernel panic, effectively causing the system to crash and resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:24:13 UTC 
In the Linux kernel, the following vulnerability has been resolved:

mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend

Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() to
simplify error handling. pm_runtime_resume_and_get() automatically
drops the usage counter on failure, avoiding the need for a separate
pm_runtime_put_noidle() call. If it fails, the device is unclocked and
accessing hardware registers would cause a kernel panic, so return the
error immediately.
Comment 1 Keith Grant 2026-08-17 13:40:33 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081503-CVE-2026-68463-4c2b@gregkh/T