CVE-2026-64494 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
iio: light: gp2ap002: fix runtime PM leak on read error
gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runtime_put_autosuspend() call at the "out" label, permanently leaking a runtime PM reference and preventing the device from autosuspending.
Replace the direct return with a "goto out" to ensure the reference is properly dropped on the error path.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in question affects the Linux kernel's industrial I/O subsystem specifically within the gp2ap002 light sensor driver implementation. This issue represents a runtime power management resource leak that occurs during error handling scenarios, fundamentally compromising the device's ability to enter low power states automatically. The problem manifests when the gp2ap002_read_raw() function attempts to read ambient light values from the sensor device while maintaining proper power management state tracking.
The technical flaw stems from improper error path handling within the driver's code execution flow. When pm_runtime_get_sync() is invoked to acquire a runtime power management reference before attempting to read the lux value, the implementation fails to release this reference if the subsequent gp2ap002_get_lux() operation encounters an error condition. The direct return statement bypasses the normal cleanup path that would typically execute the pm_runtime_put_autosuspend() call at the "out" label, leaving the power management reference in an acquired state indefinitely.
This runtime PM leak creates a persistent resource contention issue where the device remains in an active power state despite not being actively utilized for light measurements. The continuous acquisition of runtime power management references prevents the underlying hardware from transitioning to autosuspend mode, which can lead to increased power consumption and reduced battery life in mobile or embedded systems that rely on this sensor driver. The vulnerability directly violates proper resource management practices by failing to maintain balanced acquire/release operations in error conditions.
From a cybersecurity perspective, this issue constitutes a denial of service vulnerability that could potentially be exploited to degrade system performance through unnecessary power consumption patterns. The flaw aligns with CWE-473 as it involves improper handling of runtime power management references, and represents a failure in maintaining proper resource lifecycle management within the kernel's device driver framework. The operational impact extends beyond simple power efficiency concerns to encompass broader system reliability issues, particularly in environments where multiple sensor devices may exhibit similar patterns of resource leakage.
The recommended mitigation strategy involves implementing proper error path handling through the use of goto statements to ensure all code paths execute the necessary cleanup operations. This approach follows established kernel development practices for managing runtime power management references and prevents the accumulation of unreleased power management tokens. The fix ensures that regardless of whether sensor read operations succeed or fail, the corresponding runtime power management reference is properly released, allowing devices to return to their expected autosuspend states. This solution aligns with ATT&CK technique T1547.005 for privilege escalation through kernel-level resource manipulation and demonstrates proper adherence to Linux kernel driver development best practices for resource lifecycle management.