CVE-2026-89934: iio: light: ltrf216a: fix runtime PM reference leak in error path
In the Linux kernel, the following vulnerability has been resolved:
iio: light: ltrf216a: fix runtime PM reference leak in error path
ltrf216agetlux() acquires a runtime PM reference by calling ltrf216asetpowerstate(data, true). However, if ltrf216areaddata() fails, the function returns immediately without dropping the reference.
This leaves the runtime PM usage count unbalanced, preventing the device from autosuspending after a failed read.
Fix this by releasing the runtime PM reference before returning from the error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ltrf216a_get_lux(), when ltrf216a_read_data() fails, do not return immediately; ensure the runtime PM usage count is balanced by releasing the runtime PM reference that was acquired in ltrf216a_get_lux() (i.e., fix the runtime PM reference leak in the error path) before returning.
Linux kernel: iio: light: ltrf216a runtime PM reference handling (error path) = release runtime PM reference before returning from the error path
Event History
Frequently Asked Questions
What conditions trigger the issue?
The issue occurs when ltrf216a_get_lux() successfully acquires a runtime PM reference but ltrf216a_read_data() subsequently fails. The error path then returns without releasing the reference.
What is the operational impact of an affected system?
After a failed sensor read, the runtime PM usage count remains elevated. This prevents the affected device from autosuspending.
How can I tell whether the issue has occurred?
The relevant symptom is a failed read through ltrf216a_read_data() followed by the device not autosuspending because its runtime PM usage count is unbalanced.