CVE-2026-72009

The CVSS 7.8 assigned to CVE-2026-72009 misrepresents the actual threat profile for this vulnerability. This is not a traditional kernel vulnerability with a clean exploit path — it's a hardware architecture flaw in the i.MX93 SoC's power domain hierarchy that can only manifest under very specific local conditions involving concurrent DSI (display) and CSI (camera) peripheral access. The EPSS score of 0.00161 correctly reflects that exploitation in the wild is extraordinarily unlikely. The underlying issue is a race condition in how DSI and CSI share control bits for clocks and resets. When one domain disables a shared resource while the other remains active, the behavior is undefined — potentially manifesting as corrupted display frames in an HMI, a system hang in a PLC, or other unpredictable failures. The exact failure mode matters significantly: automotive HUD corruption and industrial control system hangs carry different consequence profiles, neither well-modeled by the CVSS vector. For defenders, the critical insight is that the 'fix' isn't a patch in the traditional sense — it's an architectural refactor that introduces a shared parent power domain to coordinate DSI/CSI access. This changes your remediation approach. You should not treat this as a standard patch-apply cycle. Instead, validate your specific hardware configuration: determine whether your deployment actually triggers concurrent DSI/CSI usage, confirm which kernel version contains the domain hierarchy refactor, and test the new coordination logic in your specific peripheral configuration before fleet deployment. The blast radius extends to any industrial or automotive deployment using i.MX93 where display and camera peripherals operate simultaneously. The i.MX93 powers HMIs, vehicle clusters, and PLCs where a display pipeline glitch or system hang has safety implications beyond simple availability loss. Two non-obvious risks deserve attention. First, the old code path that directly manipulated shared control bits may persist in vendor forks, out-of-tree drivers, or legacy builds — the vulnerability isn't patched so much as buried under a new architectural layer. Second, the new shared parent domain introduces new coordination complexity that could become its own attack surface in future peripheral combinations. Monitor for regressions in DSI/CSI co-usage scenarios after applying the architectural fix.

Reviewed through automated stages and approved by a human before publication.