CVE-2026-98437 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
media: qcom: iris: fix runtime PM reference leaks
Use pm_runtime_resume_and_get() in iris_enable_power_domains() to avoid leaking a runtime PM usage count on failure.
Also ensure pm_runtime_put_sync() is always called in iris_disable_power_domains(), even when iris_opp_set_rate() fails, so runtime PM references remain balanced.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel media subsystem driver for Qualcomm Iris video codecs contains a resource management flaw related to power management reference counting. Specifically, the vulnerability exists within the functions responsible for enabling and disabling power domains for the hardware device. In complex system-on-chip architectures like those produced by Qualcomm, efficient power management is critical for both energy conservation and thermal regulation. The kernel provides specific APIs to manage these states, requiring drivers to carefully balance usage counts when transitioning devices between active and suspended states. Failure to do so can lead to resource leaks that degrade system stability over time or prevent the device from entering low-power sleep modes correctly.
The technical flaw manifests in two distinct areas of the driver code. First, in the iris_enable_power_domains function, previous implementations did not properly handle errors during runtime power management operations. If a failure occurred after incrementing the usage count but before completing other initialization steps, the reference was never decremented. This results in a persistent leak where the kernel believes the device is still actively used even when it should be idle or suspended. To resolve this, the fix replaces standard calls with pm_runtime_resume_and_get(), which atomically resumes the runtime PM and increments the usage count while ensuring that any errors are handled without leaving dangling references. This function simplifies error handling by combining resume and get operations into a single atomic step, reducing the window for race conditions or missed cleanup paths.
Secondly, in the iris_disable_power_domains function, there was an inconsistency in how power domain disabling was executed upon failure of related operations such as setting operating performance points via iris_opp_set_rate(). Previously, if this intermediate operation failed, the code path would exit without calling pm_runtime_put_sync(), leaving the runtime PM reference count elevated. This imbalance prevents the kernel from correctly tracking when the device is truly unused. The corrected implementation ensures that pm_runtime_put_sync() is invoked in all execution paths of iris_disable_power_domains, regardless of whether subsequent operations succeed or fail. By guaranteeing symmetry between get and put calls, the driver maintains accurate state tracking for the hardware power domains.
From a security and stability perspective, this vulnerability falls under CWE-401, which describes missing release of memory after successful allocation, although in this context it applies to reference counts rather than heap memory. The improper handling of runtime PM references can lead to resource exhaustion over long uptimes or frequent device toggling. While not directly exploitable for remote code execution, such leaks contribute to system instability and potential denial-of-service conditions by preventing proper power state transitions. This behavior aligns with ATT&CK technique T1496, Resource Hijacking, specifically in the context of exhausting local resources like power management states or battery life through inefficient resource tracking.
The remediation involves updating the driver logic to strictly adhere to kernel power management best practices. Developers must ensure that every increment of a runtime PM usage count is matched by a corresponding decrement on all exit paths, including error handlers. Using helper functions like pm_runtime_resume_and_get() reduces boilerplate code and minimizes human error in complex conditional blocks. This fix ensures that the Iris driver correctly manages power domains, thereby preserving system battery life, reducing thermal output, and maintaining overall kernel stability during media processing tasks involving Qualcomm hardware accelerators.