CVE-2026-98679 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
iio: accel: kxcjk-1013: reject duplicate event disable
The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013_write_event_config() already ignores repeated enable requests, but a repeated disable request still calls kxcjk1013_set_power_state(data, false), dropping a runtime PM reference that was not acquired for this request. This can underflow the runtime PM usage count and trigger a "Runtime PM usage count underflow" warning.
Return early when the requested state already matches ev_enable_state.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel's Industrial I/O subsystem manages hardware sensors through a complex framework that handles event configuration, power management, and data acquisition. A specific vulnerability was identified within the kxcjk-1013 accelerometer driver, which is part of this infrastructure. The core issue stems from an inconsistency in how duplicate write operations to the event enable attribute are handled by both the IIO core layer and the specific device driver implementation. While the IIO core does not inherently filter out redundant writes sent by user-space applications or other kernel components, the kxcjk-1013 driver was designed with partial protection against such redundancy for enabling events but lacked corresponding safeguards for disabling them.
The technical flaw resides in the kxcjk_1013_write_event_config function within the driver code. When a request is made to disable an event that is already disabled, the existing logic fails to recognize this redundant state and proceeds to execute power management routines unnecessarily. Specifically, it invokes the kxcjk_1013_set_power_state function with a false argument, which attempts to drop a runtime Power Management reference count. However, because no corresponding reference was acquired for this specific disable request due to its redundancy, the operation results in an underflow of the device's runtime PM usage counter. This condition triggers a kernel warning indicating a Runtime PM usage count underflow, signaling that the internal state tracking has become inconsistent with actual hardware power states.
From an operational perspective, while immediate system crashes may not always occur due to this specific flaw, persistent underflows can lead to unpredictable behavior in device power management. The runtime PM subsystem relies on accurate reference counting to determine when a device should be suspended or resumed. An incorrect count can cause the kernel to incorrectly suspend active devices prematurely or fail to resume them properly, leading to sensor malfunctions, increased latency, or potential instability in systems relying heavily on precise timing and continuous data acquisition from these accelerometers. This represents a denial of service vector where local users could potentially disrupt device functionality through repeated write operations.
The resolution involves modifying the kxcjk_1013_write_event_config function to check if the requested state already matches the current internal ev_enable_state before proceeding with any power management changes. By returning early when no actual change in state is required, the driver avoids executing unnecessary code paths that could corrupt reference counts. This fix aligns the disable logic with the existing enable logic, ensuring idempotency for event configuration writes and maintaining the integrity of the runtime PM subsystem.
This vulnerability maps to CWE-841 Improper Enforcement of Behavioral Workflow, as the system failed to properly enforce the correct sequence or state validation before executing side effects like power management adjustments. It also relates to CWE-362 Concurrent Execution Using Shared Resource with Insufficient Synchronization if viewed in contexts where multiple threads might trigger these writes concurrently, though primarily it is a logic error in state handling. In terms of MITRE ATT&CK, this could be categorized under T1548 Abuse Configuration or T1070 Indicator Removal on Host if an attacker were to exploit the resulting instability for evasion purposes, but fundamentally it represents a software defect rather than a direct attack technique. Mitigation requires applying the kernel patch that updates the driver logic to validate current state against requested state prior to invoking power management functions, thereby preventing reference count corruption and ensuring stable operation of IIO devices.